chore(infra): auth fast-path, pg pool tuning, react-doctor devdep

Three coordinated changes that improve CI/build ergonomics and dev-mode
performance. None change database schema; all are reversible by env var.

src/lib/auth.ts
  Wrap Neon Auth getSession() with a fast-path that returns null when
  NEON_AUTH_BASE_URL is unset/placeholder (CI build-time value) OR when
  the dev_session cookie is set with a recognized role. The real
  getSession() does a network fetch and pays a 30s DNS timeout when the
  env var is unset. Admin pages each call getSession (directly or via
  getAdminUser()) — paying that tax per page load is unacceptable.

src/lib/db.ts + db/client.ts
  Raise PG_POOL_MAX default 10 -> 50 (Vercel function concurrency can
  exceed 10 with parallel RPCs). Lower PG_POOL_CONN_TIMEOUT_MS default
  30s -> 5s in src/lib/db.ts and 10s -> 5s in db/client.ts so a bad
  Neon branch fails fast instead of hanging requests.

src/lib/admin-permissions.ts + src/proxy.ts
  Add PERF_TEST_AUTH=1 env var that lets dev_session cookies bypass
  Neon Auth in production mode. Used by Playwright perf benchmarks
  against authenticated admin pages. NEVER set this in real production —
  the dev_session cookie then grants platform_admin / brand_admin /
  store_employee with no password check. The middleware guard in
  proxy.ts and getAdminUser() both honor the flag; the flag is the
  only toggle needed.

package.json
  Add react-doctor ^0.5.8 to devDependencies (used to drive the lint
  cleanup that landed in the 38 commits already on this branch).

package.json

@@ -72,6 +72,7 @@
     "jsdom": "^25.0.1",
     "pg": "^8.20.0",
     "playwright": "^1.59.1",
+    "react-doctor": "^0.5.8",
     "tailwindcss": "^4",
     "tsx": "^4.22.4",
     "typescript": "^5",