chore(infra): auth fast-path, pg pool tuning, react-doctor devdep

Three coordinated changes that improve CI/build ergonomics and dev-mode
performance. None change database schema; all are reversible by env var.

src/lib/auth.ts
  Wrap Neon Auth getSession() with a fast-path that returns null when
  NEON_AUTH_BASE_URL is unset/placeholder (CI build-time value) OR when
  the dev_session cookie is set with a recognized role. The real
  getSession() does a network fetch and pays a 30s DNS timeout when the
  env var is unset. Admin pages each call getSession (directly or via
  getAdminUser()) — paying that tax per page load is unacceptable.

src/lib/db.ts + db/client.ts
  Raise PG_POOL_MAX default 10 -> 50 (Vercel function concurrency can
  exceed 10 with parallel RPCs). Lower PG_POOL_CONN_TIMEOUT_MS default
  30s -> 5s in src/lib/db.ts and 10s -> 5s in db/client.ts so a bad
  Neon branch fails fast instead of hanging requests.

src/lib/admin-permissions.ts + src/proxy.ts
  Add PERF_TEST_AUTH=1 env var that lets dev_session cookies bypass
  Neon Auth in production mode. Used by Playwright perf benchmarks
  against authenticated admin pages. NEVER set this in real production —
  the dev_session cookie then grants platform_admin / brand_admin /
  store_employee with no password check. The middleware guard in
  proxy.ts and getAdminUser() both honor the flag; the flag is the
  only toggle needed.

package.json
  Add react-doctor ^0.5.8 to devDependencies (used to drive the lint
  cleanup that landed in the 38 commits already on this branch).

db/client.ts

@@ -74,10 +74,10 @@ function getPool(): Pool {
   }
   _pool = new Pool({
     connectionString,
-    max: parseInt(process.env.PG_POOL_MAX ?? "10", 10),
+    max: parseInt(process.env.PG_POOL_MAX ?? "50", 10),
     idleTimeoutMillis: parseInt(process.env.PG_POOL_IDLE_MS ?? "30000", 10),
     connectionTimeoutMillis: parseInt(
-      process.env.PG_POOL_CONN_TIMEOUT_MS ?? "10000",
+      process.env.PG_POOL_CONN_TIMEOUT_MS ?? "5000",
       10,
     ),
     allowExitOnIdle: false,