feat: remove dev_session, add Drizzle schema + RLS + real auth

BREAKING: dev_session cookie bypass removed. Admin access now requires
a real Auth.js v5 session (Google OAuth in production). Provision users
by inserting into users + tenant_users tables.

New in this commit:
- db/migrations/0001_init.sql: 18-table SaaS schema with RLS (tenants,
  users, tenant_users, plans, add_ons, subscriptions, tenant_add_ons,
  products, product_images, stops, customers, orders, order_items,
  brand_settings, email_templates, campaigns, files, audit_log)
- db/schema/: Drizzle TypeScript mirror of every table
- db/client.ts: withTenant() / withPlatformAdmin() query wrappers that
  set Postgres GUCs (app.current_tenant_id, app.platform_admin) for
  RLS enforcement. Never query a tenant-scoped table without one.
- db/seed.ts: seeds 3 plans, 6 add-ons, 2 tenants (Tuxedo, Indian River
  Direct), brand_settings, sample products/stops/customers
- scripts/migrate.js: applies migrations in lexical order with tracking
- scripts/db-reset.js: drops + recreates DB, runs migrate + seed
- DATABASE_URL now uses rc_app (non-superuser, NOBYPASSRLS). RLS is
  enforced even for the app user. DATABASE_ADMIN_URL for migrations.
- src/lib/admin-permissions.ts: getAdminUser() reads Auth.js session,
  looks up user + tenant in Postgres. brand_id kept as alias for
  backward compat.
- src/middleware.ts: Auth.js-only route protection, dev_session gone
- src/app/login/LoginClient.tsx: Google OAuth only, no demo mode
- src/components/admin/AdminSidebar.tsx + AdminHeader.tsx: signOutAction
  replaces supabase signout
- @/db/* path aliases in tsconfig.json + vitest.config.ts
- drizzle.config.ts added
- db/auth_schema.sql removed (was a stub; replaced by real schema)
- src/app/api/dev-login/route.ts deleted
- tests: updated to remove dev_session coverage

src/app/admin/me/AdminMeClient.tsx

@@ -2,9 +2,7 @@
 
 import { useState } from "react";
 import Link from "next/link";
-import { supabase } from "@/lib/supabase";
 import { AdminUserRow } from "@/actions/admin/users";
-import { logUserActivity } from "@/actions/admin/audit";
 
 type ProfilePageProps = {
   currentUser: AdminUserRow;
@@ -21,53 +19,24 @@ export default function AdminMeClient({ currentUser }: ProfilePageProps) {
   const [newEmail, setNewEmail] = useState("");
   const [emailError, setEmailError] = useState<string | null>(null);
 
+  // Profile / email mutations used to call Supabase directly. With the
+  // platform moved off Supabase entirely, those handlers are stubbed out
+  // — the page remains read-only until a server-action equivalent ships.
+  // See the final YOLO report for the broader Supabase → pg data-fetch
+  // migration that covers the rest of the admin pages.
+
   async function handleSaveProfile(e: React.FormEvent) {
     e.preventDefault();
     setSaving(true);
-    setError(null);
-    try {
-      const { error: rpcError } = await supabase.rpc("update_admin_user", {
-        p_id: currentUser.id,
-        p_display_name: displayName || null,
-        p_phone_number: phoneNumber || null,
-      });
-      if (rpcError) {
-        setError(rpcError.message);
-        return;
-      }
-      await logUserActivity({
-        user_id: currentUser.user_id,
-        activity_type: "profile_update",
-        details: { fields: ["display_name", "phone_number"] },
-      });
-      setEditing(false);
-    } finally {
-      setSaving(false);
-    }
+    setError("Profile editing is temporarily unavailable. Contact a platform admin.");
+    setSaving(false);
   }
 
   async function handleEmailChange(e: React.FormEvent) {
     e.preventDefault();
     setChangingEmail(true);
-    setEmailError(null);
-    try {
-      const { error: updateError } = await supabase.auth.updateUser({
-        email: newEmail,
-      });
-      if (updateError) {
-        setEmailError(updateError.message);
-        return;
-      }
-      await logUserActivity({
-        user_id: currentUser.user_id,
-        activity_type: "email_change",
-        details: { new_email: newEmail },
-      });
-      setEmailChangeSent(true);
-      setChangingEmail(false);
-    } finally {
-      setChangingEmail(false);
-    }
+    setEmailError("Email changes are temporarily unavailable. Contact a platform admin.");
+    setChangingEmail(false);
   }
 
   return (