feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

deploy/Dockerfile.nextjs

@@ -1,57 +1,79 @@
 # =============================================================================
 # Dockerfile.nextjs — multi-stage build for the Next.js frontend
 # =============================================================================
-# Used by docker-compose.yml's `nextjs` service.
 #
-# Why this looks the way it does:
-#   - `NEXT_PUBLIC_API_URL` must be present at BUILD time (Next.js inlines
-#     it into the client JS). We pass it through as an ARGs so the build
-#     context is reproducible (`docker build --build-arg` or via deploy.sh's
-#     `docker compose --env-file` flow).
-#   - We copy the host's pre-built `.next/` (produced by `npm run build` in
-#     deploy.sh) rather than running `next build` inside the image. This
-#     keeps the image lean and avoids double-building.
+# Production-ready Docker image for Next.js with:
+#   - Multi-stage build for minimal image size
+#   - Standalone server output for containerized deployment
+#   - Non-root user for security
+#   - Health check support
+#
+# Build args (set via --build-arg or docker-compose args):
+#   - NEXT_PUBLIC_API_URL: Public URL for the frontend (inlined at build time)
+#   - NODE_ENV: Environment (defaults to production)
+#
+# Required: next.config.ts must have `output: "standalone"` enabled.
 # =============================================================================
 
-# ---- builder: produce node_modules with dev deps for the build step --------
+# ── Stage 1: Dependencies ────────────────────────────────────────────────────
 FROM node:20-alpine AS deps
 WORKDIR /app
-COPY package.json package-lock.json* ./
-RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
 
-# ---- builder: produce the standalone .next/ output ------------------------
+# Copy package files
+COPY package.json package-lock.json* ./
+
+# Install dependencies
+RUN if [ -f package-lock.json ]; then \
+      npm ci --no-audit --no-fund; \
+    else \
+      npm install --no-audit --no-fund; \
+    fi
+
+# ── Stage 2: Build ───────────────────────────────────────────────────────────
 FROM node:20-alpine AS builder
 WORKDIR /app
+
+# Copy node_modules from deps stage
 COPY --from=deps /app/node_modules ./node_modules
+
+# Copy source files
 COPY . .
 
-# These ARGs are wired through docker-compose's `args:` block (or the CLI).
-# deploy.sh exports them in the build environment.
-ARG NEXT_PUBLIC_API_URL
+# Set build arguments (inlined into client bundle)
+ARG NEXT_PUBLIC_API_URL=http://localhost:3000
 ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
-ARG NEXTJS_HOST_PORT
-ENV NEXTJS_HOST_PORT=${NEXTJS_HOST_PORT}
+ARG NODE_ENV=production
+ENV NODE_ENV=${NODE_ENV}
 
+# Build the Next.js application
 RUN npm run build
 
-# ---- runner: minimal image, standalone server -----------------------------
+# ── Stage 3: Runtime ─────────────────────────────────────────────────────────
 FROM node:20-alpine AS runner
 WORKDIR /app
+
+# Set production environment
 ENV NODE_ENV=production
 ENV PORT=3000
 
-# Run as non-root.
+# Create non-root user for security
 RUN addgroup --system --gid 1001 nodejs \
- && adduser  --system --uid 1001 nextjs
+ && adduser --system --uid 1001 nextjs
 
-# Copy only what the standalone server needs.
+# Copy standalone server and static assets from builder
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 COPY --from=builder --chown=nextjs:nodejs /app/public ./public
 
-USER nextjs
+# Expose the port
 EXPOSE 3000
 
-# Adjust this CMD to match the actual server file your build emits.
-# For `output: "standalone"` in next.config.js the file is server.js.
+# Switch to non-root user
+USER nextjs
+
+# Health check
+HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=6 \
+  CMD wget -qO- http://localhost:3000/ || exit 1
+
+# Start the standalone server
 CMD ["node", "server.js"]