feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

deploy/Dockerfile.nextjs

@@ -1,57 +1,79 @@
 # =============================================================================
 # Dockerfile.nextjs — multi-stage build for the Next.js frontend
 # =============================================================================
-# Used by docker-compose.yml's `nextjs` service.
 #
-# Why this looks the way it does:
-#   - `NEXT_PUBLIC_API_URL` must be present at BUILD time (Next.js inlines
-#     it into the client JS). We pass it through as an ARGs so the build
-#     context is reproducible (`docker build --build-arg` or via deploy.sh's
-#     `docker compose --env-file` flow).
-#   - We copy the host's pre-built `.next/` (produced by `npm run build` in
-#     deploy.sh) rather than running `next build` inside the image. This
-#     keeps the image lean and avoids double-building.
+# Production-ready Docker image for Next.js with:
+#   - Multi-stage build for minimal image size
+#   - Standalone server output for containerized deployment
+#   - Non-root user for security
+#   - Health check support
+#
+# Build args (set via --build-arg or docker-compose args):
+#   - NEXT_PUBLIC_API_URL: Public URL for the frontend (inlined at build time)
+#   - NODE_ENV: Environment (defaults to production)
+#
+# Required: next.config.ts must have `output: "standalone"` enabled.
 # =============================================================================
 
-# ---- builder: produce node_modules with dev deps for the build step --------
+# ── Stage 1: Dependencies ────────────────────────────────────────────────────
 FROM node:20-alpine AS deps
 WORKDIR /app
-COPY package.json package-lock.json* ./
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
-# ---- builder: produce the standalone .next/ output ------------------------
+# Copy package files
+COPY package.json package-lock.json* ./
+
+# Install dependencies
+RUN if [ -f package-lock.json ]; then \
+      npm ci --no-audit --no-fund; \
+    else \
+      npm install --no-audit --no-fund; \
+    fi
+
+# ── Stage 2: Build ───────────────────────────────────────────────────────────
 FROM node:20-alpine AS builder
 WORKDIR /app
+
+# Copy node_modules from deps stage
 COPY --from=deps /app/node_modules ./node_modules
+
+# Copy source files
 COPY . .
 
-# These ARGs are wired through docker-compose's `args:` block (or the CLI).
-# deploy.sh exports them in the build environment.
-ARG NEXT_PUBLIC_API_URL
+# Set build arguments (inlined into client bundle)
+ARG NEXT_PUBLIC_API_URL=http://localhost:3000
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
-ARG NEXTJS_HOST_PORT
-ENV NEXTJS_HOST_PORT=${NEXTJS_HOST_PORT}
+ARG NODE_ENV=production
+ENV NODE_ENV=${NODE_ENV}
 
+# Build the Next.js application
 RUN npm run build
 
-# ---- runner: minimal image, standalone server -----------------------------
+# ── Stage 3: Runtime ─────────────────────────────────────────────────────────
 FROM node:20-alpine AS runner
 WORKDIR /app
+
+# Set production environment
 ENV NODE_ENV=production
 ENV PORT=3000
 
-# Run as non-root.
+# Create non-root user for security
 RUN addgroup --system --gid 1001 nodejs \
- && adduser  --system --uid 1001 nextjs
+ && adduser --system --uid 1001 nextjs
 
-# Copy only what the standalone server needs.
+# Copy standalone server and static assets from builder
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 
-USER nextjs
+# Expose the port
 EXPOSE 3000
 
-# Adjust this CMD to match the actual server file your build emits.
-# For `output: "standalone"` in next.config.js the file is server.js.
+# Switch to non-root user
+USER nextjs
+
+# Health check
+HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
+  CMD wget -qO- http://localhost:3000/ || exit 1
+
+# Start the standalone server
 CMD ["node", "server.js"]

deploy/docker-compose.yml

@@ -2,19 +2,50 @@
 # docker-compose.yml — production stack consumed by deploy.sh
 # =============================================================================
 #
-# Only `postgrest` lives in docker. Postgres itself runs on the host
-# (the deploy workflow applies migrations via `psql -h 127.0.0.1`).
-# Next.js runs under PM2 on the host — it is NOT a docker service.
+# Complete Docker stack for production deployment:
+#   - Next.js frontend (Node.js standalone server)
+#   - PostgREST API (optional, for direct PostgreSQL access)
 #
-# The host-side port (POSTGREST_HOST_PORT) is written by the deploy
-# workflow into $APP_DIR/.env. We interpolate from there with
-# ${VAR:-3011} so a manual `docker compose up` without the deploy
-# script still works.
+# Postgres itself runs on the host (the deploy workflow applies migrations
+# via `psql -h 127.0.0.1`). Next.js can also run under PM2 on the host —
+# this compose file provides a Docker alternative for the frontend.
+#
+# The host-side ports are written by the deploy workflow into $APP_DIR/.env.
+# We interpolate from there with ${VAR:-default} so a manual
+# `docker compose up` without the deploy script still works.
 # =============================================================================
 
 name: prod-app  # default project name; deploy.sh overrides with -p
 
 services:
+  # ── Next.js Frontend ──────────────────────────────────────────────────────────
+  nextjs:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.nextjs
+      args:
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+        NODE_ENV: production
+    container_name: prod-app-nextjs
+    restart: unless-stopped
+    ports:
+      - "${NEXTJS_HOST_PORT:-3000}:3000"
+    environment:
+      NODE_ENV: production
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+      DATABASE_URL: ${DATABASE_URL}
+      # Pass other env vars as needed
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 30s
+    # Volume mount for hot-reload in development (comment out for production)
+    # volumes:
+    #   - ../src:/app/src:ro
+
+  # ── PostgREST (optional direct PostgreSQL access) ────────────────────────────
   postgrest:
     image: postgrest/postgrest:latest
     container_name: prod-app-postgrest
@@ -29,6 +60,9 @@ services:
       PGRST_SERVER_PORT: 3000
       # Optional: tighten CORS for your real domain
       PGRST_DB_TXN_END: "commit-allow-overwrite"
+    depends_on:
+      nextjs:
+        condition: service_healthy
     # Healthcheck lets `docker compose ps` show healthy state.
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]