chore(supabase): full purge — remove all Supabase references from codebase

- Delete supabase/ directory (config.toml, push-migrations.js,
  ADMIN_CREATE_STOP_FIX.sql, 137 archived migration files)
- Remove @supabase/ssr and @supabase/supabase-js from package.json
- Strip *.supabase.co from next.config.ts image hostnames
- Strip https://*.supabase.co from vercel.json CSP connect-src
- Remove 'supabase/**' ignore from eslint.config.mjs
- Clean supabase references from src/lib/db.ts, vitest.config.ts,
  db/seeds/2026-tuxedo-tour-stops.sql, src/actions/storefront.ts,
  scripts/import-tuxedo-stops.ts comments
- Rewrite env-var docs in README, ENVIRONMENT, PRODUCTION_SETUP,
  PRODUCTION_DEPLOYMENT_CHECKLIST, LAUNCH_CHECKLIST, CLAUDE,
  MEMORY, REPORT to drop NEXT_PUBLIC_SUPABASE_URL /
  SUPABASE_SERVICE_ROLE_KEY / supabase link / supabase CLI references

The canonical migration runner is now scripts/migrate.js (uses pg
directly via DATABASE_URL). Migrations live in db/migrations/. The
Supabase CLI is no longer in the codebase. The only remaining
'@supabase/*' in the dep tree is @supabase/auth-js as a transitive
of @neondatabase/auth (Neon Auth / Better Auth).

Final source scan: grep -rln '@supabase\|rest/v1\|supabase\.co'
src/ tests/ db/ scripts/ next.config.ts vercel.json eslint.config.mjs
package.json returns zero. Verification: npm install clean
(11 added, 21 removed, 12 changed), tsc shows same 17 pre-existing
errors (Stripe dahlia API version + fetch preconnect mocks),
vitest 172/175 (3 pre-existing failures in getAdminUser.test.ts),
lint shows same 14 pre-existing errors. Live-tested: dev server
boots in 248ms, public storefronts (/) (/login) (/pricing) (/tuxedo)
(/indian-river-direct) all return 200; /admin/v2?demo=1 reaches 200
after dev_session redirect; storefront renders real brand content.

supabase/migrations/.archived/_000_auth_schema.sql

@@ -1,111 +0,0 @@
--- _000_auth_schema.sql
---
--- Local stand-in for the Supabase `auth` schema. Supabase ships a
--- built-in `auth.users` table and `auth.uid()` / `auth.role()` functions
--- that SECURITY DEFINER RPCs read. For a direct-Postgres deployment
--- (no Supabase platform), we recreate the minimum surface those RPCs
--- depend on, and use Postgres session GUCs to thread the caller's
--- identity from the application layer.
---
--- Production auth model:
---   - Auth.js v5 manages the user session (Google OAuth in /login,
---     `dev_session` cookie for the demo flow).
---   - Each `pg` connection that calls a SECURITY DEFINER RPC first
---     runs `SELECT set_config('app.current_user_id', $1, true)` so
---     `auth.uid()` returns the correct value inside the RPC.
---   - The app-level middleware (`getAdminUser()`) is the primary
---     authorization gate; the RPCs are a defense-in-depth check that
---     the caller is in `admin_users` and not a foreign brand.
---
--- This file is local-only and should NOT be pushed to a Supabase-hosted
--- DB (the schema already exists there).
-
--- ═══════════════════════════════════════════════════════════════════════════
--- 1. Schema
--- ═══════════════════════════════════════════════════════════════════════════
-
-CREATE SCHEMA IF NOT EXISTS auth;
-
--- ═══════════════════════════════════════════════════════════════════════════
--- 2. auth.users — minimal Supabase-compatible shape
--- ═══════════════════════════════════════════════════════════════════════════
---
--- Columns the migrations actually read:
---   id, email, raw_user_meta_data, raw_app_meta_data, encrypted_password
---   (Supabase's full schema has ~30 columns; the SECURITY DEFINER
---   functions in this codebase only need the four above.)
-
-CREATE TABLE IF NOT EXISTS auth.users (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  email TEXT UNIQUE,
-  raw_user_meta_data JSONB DEFAULT '{}'::jsonb,
-  raw_app_meta_data JSONB DEFAULT '{}'::jsonb,
-  encrypted_password TEXT,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
-);
-
--- Mirror Supabase's `auth.identities` for the `update_admin_user`
--- trigger that writes back to `auth.users`. Most migrations don't
--- touch it; kept here so a stray FK / view doesn't blow up.
-CREATE TABLE IF NOT EXISTS auth.identities (
-  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-  user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
-  provider TEXT NOT NULL,
-  provider_id TEXT NOT NULL,
-  identity_data JSONB DEFAULT '{}'::jsonb,
-  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-  UNIQUE (provider, provider_id)
-);
-
-CREATE INDEX IF NOT EXISTS auth_identities_user_id_idx
-  ON auth.identities (user_id);
-
--- ═══════════════════════════════════════════════════════════════════════════
--- 3. auth.uid() / auth.role() — session helpers
--- ═══════════════════════════════════════════════════════════════════════════
---
--- These mirror Supabase's signature. They read Postgres session GUCs
--- (`app.current_user_id` and `app.current_user_role`) that the
--- application layer sets before calling SECURITY DEFINER RPCs:
---
---   await client.query("SELECT set_config('app.current_user_id', $1, true)", [userId]);
---   await client.rpc("get_admin_users", { p_brand_id });
---
--- The `true` argument makes the setting transaction-local, so it
--- auto-resets at COMMIT / ROLLBACK — no leakage across pooled
--- connections.
-
-CREATE OR REPLACE FUNCTION auth.uid()
-RETURNS UUID
-LANGUAGE sql
-STABLE
-AS $$
-  SELECT NULLIF(current_setting('app.current_user_id', true), '')::UUID;
-$$;
-
-CREATE OR REPLACE FUNCTION auth.role()
-RETURNS TEXT
-LANGUAGE sql
-STABLE
-AS $$
-  SELECT COALESCE(NULLIF(current_setting('app.current_user_role', true), ''), 'anon');
-$$;
-
--- ═══════════════════════════════════════════════════════════════════════════
--- 4. notify_pgrst — stub for PostgREST schema-reload signaling
--- ═══════════════════════════════════════════════════════════════════════════
---
--- Some migrations `NOTIFY pgrst, 'reload schema'` to tell PostgREST to
--- refresh its cache. In a direct-pg deployment, no PostgREST runs, so
--- this is a no-op.
-
-CREATE OR REPLACE FUNCTION public.notify_pgrst()
-RETURNS void
-LANGUAGE plpgsql
-AS $$
-BEGIN
-  -- no-op: no PostgREST to notify in a direct-pg deployment
-  NULL;
-END;
-$$;