feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/auth-actions.ts

@@ -1,44 +1,14 @@
 "use server";
 
 import "server-only";
-import { signIn, signOut } from "@/lib/auth";
+import { signOut } from "@/lib/auth";
 import { redirect } from "next/navigation";
 
 /**
- * Kick off the Google OAuth flow. Auth.js will redirect to Google's
- * consent screen and then back to /api/auth/callback/google, which sets
- * the session cookie and redirects to /admin.
- */
-export async function signInWithGoogle(): Promise<void> {
-  await signIn("google", { redirectTo: "/admin" });
-}
-
-/**
- * Sign in with email + password. The `credentials` provider is enabled
- * in dev (see `isDevLoginEnabled()` in `src/auth.config.ts`); in
- * production it is omitted entirely and this action returns an
- * `AuthError` (Auth.js surfaces `?error=Configuration` on /login).
- *
- * On a failed credential check Auth.js redirects back to
- * /login?error=CredentialsSignin, which the LoginClient renders as
- * "Invalid email or password."
- */
-export async function signInWithCredentials(formData: FormData): Promise<void> {
-  const email = String(formData.get("email") ?? "").trim().toLowerCase();
-  const password = String(formData.get("password") ?? "");
-  if (!email || !password) {
-    redirect("/login?error=MissingCredentials");
-  }
-  await signIn("credentials", {
-    email,
-    password,
-    redirectTo: "/admin",
-  });
-}
-
-/**
- * Sign out and clear the Auth.js session cookie.
+ * Sign out and clear the Neon Auth session cookie.
  */
 export async function signOutAction(): Promise<void> {
-  await signOut({ redirectTo: "/login" });
+  console.log("[auth/sign-out] Signing out");
+  await signOut();
+  redirect("/login");
 }