feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

deploy/docker-compose.yml

@@ -2,19 +2,50 @@
 # docker-compose.yml — production stack consumed by deploy.sh
 # =============================================================================
 #
-# Only `postgrest` lives in docker. Postgres itself runs on the host
-# (the deploy workflow applies migrations via `psql -h 127.0.0.1`).
-# Next.js runs under PM2 on the host — it is NOT a docker service.
+# Complete Docker stack for production deployment:
+#   - Next.js frontend (Node.js standalone server)
+#   - PostgREST API (optional, for direct PostgreSQL access)
 #
-# The host-side port (POSTGREST_HOST_PORT) is written by the deploy
-# workflow into $APP_DIR/.env. We interpolate from there with
-# ${VAR:-3011} so a manual `docker compose up` without the deploy
-# script still works.
+# Postgres itself runs on the host (the deploy workflow applies migrations
+# via `psql -h 127.0.0.1`). Next.js can also run under PM2 on the host —
+# this compose file provides a Docker alternative for the frontend.
+#
+# The host-side ports are written by the deploy workflow into $APP_DIR/.env.
+# We interpolate from there with ${VAR:-default} so a manual
+# `docker compose up` without the deploy script still works.
 # =============================================================================
 
 name: prod-app  # default project name; deploy.sh overrides with -p
 
 services:
+  # ── Next.js Frontend ──────────────────────────────────────────────────────────
+  nextjs:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile.nextjs
+      args:
+        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+        NODE_ENV: production
+    container_name: prod-app-nextjs
+    restart: unless-stopped
+    ports:
+      - "${NEXTJS_HOST_PORT:-3000}:3000"
+    environment:
+      NODE_ENV: production
+      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL:-http://localhost:3000}
+      DATABASE_URL: ${DATABASE_URL}
+      # Pass other env vars as needed
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 30s
+    # Volume mount for hot-reload in development (comment out for production)
+    # volumes:
+    #   - ../src:/app/src:ro
+
+  # ── PostgREST (optional direct PostgreSQL access) ────────────────────────────
   postgrest:
     image: postgrest/postgrest:latest
     container_name: prod-app-postgrest
@@ -29,6 +60,9 @@ services:
       PGRST_SERVER_PORT: 3000
       # Optional: tighten CORS for your real domain
       PGRST_DB_TXN_END: "commit-allow-overwrite"
+    depends_on:
+      nextjs:
+        condition: service_healthy
     # Healthcheck lets `docker compose ps` show healthy state.
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/"]