feat(admin): multi-brand admin support

Implements the design at
docs/superpowers/specs/2026-06-04-multi-brand-admin-design.md.

Adds:
- admin_user_brands junction table (m:n admin<->brand) via migration 207
- New role 'multi_brand_admin' (auto-set when an admin has 2+ brands)
- 'active_brand_id' cookie that persists the admin's currently-selected
  brand across navigations; switchable via the new BrandSelector dropdown
  in the sidebar
- Centralised brand resolution in src/lib/brand-scope.ts:
  - getActiveBrandId (URL > cookie > legacy brand_id > first of brand_ids)
  - assertBrandAccess (defence-in-depth for cases where the brandId
    comes from a URL form or RPC return)
- ~30 server actions and ~10 page server components migrated to use
  getActiveBrandId instead of the silent brandId ?? adminUser.brand_id
  pattern that allowed cross-brand access bugs
- BrandSelector client component with proper a11y (aria-haspopup,
  aria-expanded, role=listbox, outside-click and escape-to-close)

Migration 207 also adds RLS so admins can read their own junction rows
(needed for the dropdown to populate) and SECURITY DEFINER RPCs
add/remove_admin_user_brand that auto-promote/demote between
brand_admin and multi_brand_admin.

Notes:
- Migration number is 207 not 204 — 204-206 were taken in this worktree
  by the concurrent locations work.
- The legacy admin_users.brand_id column is preserved for backwards
  compat; a follow-up migration 220_* will drop it.
- Dev sessions (dev_session cookie, NEXT_PUBLIC_USE_MOCK_DATA) get
  brand_ids: []; the documented limitation is that dev store_employee
  will see <AdminAccessDenied /> if no real brands exist.
- Pages that hardcode a Tuxedo brand UUID as a fallback
  (adminUser.brand_id ?? '64294306-...') are NOT migrated in this PR —
  they still work for single-brand admins and are out of scope.

Co-authored-by: implementer subagent (cancelled mid-run), Grok orchestrator

src/app/admin/stops/page.tsx

@@ -4,6 +4,7 @@ import StopsLocationsTabs from "@/components/admin/StopsLocationsTabs";
 import StatsStrip from "@/components/admin/StatsStrip";
 import { supabase } from "@/lib/supabase";
 import { getAdminUser } from "@/lib/admin-permissions";
+import { getActiveBrandId } from "@/lib/brand-scope";
 import { adminListLocations } from "@/actions/locations";
 import AdminAccessDenied from "@/components/admin/AdminAccessDenied";
 import { PageHeader } from "@/components/admin/design-system";
@@ -39,6 +40,8 @@ export default async function AdminStopsPage({ searchParams }: PageProps) {
   // Always fetch stops + locations; the page is fast and a server component can
   // hand both to the client. The Locations tab only needs the array — it does
   // its own filtering in JS. Stops tab uses the existing client table.
+  const activeBrandId = await getActiveBrandId(adminUser);
+
   const stopsQuery = supabase
     .from("stops")
     .select(`
@@ -49,13 +52,13 @@ export default async function AdminStopsPage({ searchParams }: PageProps) {
     .is("deleted_at", null)
     .order("date", { ascending: true });
 
-  if (adminUser?.brand_id) {
-    stopsQuery.eq("brand_id", adminUser.brand_id);
+  if (activeBrandId) {
+    stopsQuery.eq("brand_id", activeBrandId);
   }
 
   const [{ data: stops, error: stopsError }, locations] = await Promise.all([
     stopsQuery,
-    adminListLocations(adminUser.brand_id ?? ""),
+    adminListLocations(activeBrandId ?? ""),
   ]);
 
   if (stopsError) {