chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

supabase/migrations/.archived/209_authjs_auto_create_admin.sql

@@ -1,95 +0,0 @@
--- 209_authjs_auto_create_admin.sql
--- Auto-create a platform_admin row when a new user signs in via Auth.js.
---
--- Called from the `signIn` event in `src/lib/auth.ts`. The RPC is
--- idempotent (ON CONFLICT DO NOTHING) so repeat sign-ins are no-ops.
-
--- Defensive: ensure can_manage_settings column exists. It was likely
--- added via the Supabase dashboard (it's referenced in the TypeScript
--- `AdminUser` type at `src/lib/admin-permissions-types.ts` but not in
--- any tracked migration). ADD COLUMN IF NOT EXISTS is safe to re-run.
-ALTER TABLE admin_users
-  ADD COLUMN IF NOT EXISTS can_manage_settings BOOLEAN NOT NULL DEFAULT false;
-
--- Defensive: ensure admin_users.user_id has a unique constraint so the
--- `ON CONFLICT (user_id)` below resolves. The table was created via the
--- Supabase dashboard — we can't be sure the dashboard created a UNIQUE
--- index on user_id. If the constraint is missing, the ON CONFLICT
--- clause will fail the whole "Apply migrations" step on the deploy
--- runner. Skip silently if a matching unique/primary constraint already
--- exists, otherwise add one (cleaning up any duplicate rows first so
--- the ADD CONSTRAINT doesn't fail).
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1
-    FROM pg_constraint
-    WHERE conrelid = 'public.admin_users'::regclass
-      AND contype IN ('u', 'p')           -- unique or primary key
-      AND pg_get_constraintdef(oid) ILIKE '%(user_id)%'
-  ) THEN
-    -- Shouldn't happen in practice (this RPC is the only writer for new
-    -- rows), but guard against duplicate user_id values that would
-    -- block the unique constraint from being created.
-    DELETE FROM admin_users a
-    USING admin_users b
-    WHERE a.user_id = b.user_id
-      AND a.ctid > b.ctid;
-    ALTER TABLE admin_users
-      ADD CONSTRAINT admin_users_user_id_key UNIQUE (user_id);
-  END IF;
-END $$;
-
--- SECURITY DEFINER RPC: upsert a platform_admin row for the given
--- Auth.js user id.
---
--- Bypasses RLS on admin_users (which is enabled — see
--- 109_enable_rls_critical.sql:21). Runs with the function owner's
--- privileges so the auto-create on first sign-in can always succeed.
-CREATE OR REPLACE FUNCTION upsert_admin_user_for_authjs(p_user_id UUID)
-RETURNS SETOF admin_users
-LANGUAGE plpgsql
-SECURITY DEFINER
-SET search_path = public
-AS $$
-BEGIN
-  RETURN QUERY
-  INSERT INTO admin_users (
-    user_id,
-    role,
-    active,
-    must_change_password,
-    can_manage_products,
-    can_manage_stops,
-    can_manage_orders,
-    can_manage_pickup,
-    can_manage_messages,
-    can_manage_refunds,
-    can_manage_users,
-    can_manage_water_log,
-    can_manage_reports,
-    can_manage_settings
-  )
-  VALUES (
-    p_user_id,
-    'platform_admin',
-    true,
-    false,
-    true,
-    true,
-    true,
-    true,
-    true,
-    true,
-    true,
-    true,
-    true,
-    true
-  )
-  ON CONFLICT (user_id) DO NOTHING
-  RETURNING *;
-END;
-$$;
-
--- Reload PostgREST schema cache so the new RPC is immediately callable.
-NOTIFY pgrst, 'reload schema';