feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/communications/import-contacts.ts

@@ -2,7 +2,7 @@
 
 import { and, desc, eq } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { withTenant, withPlatformAdmin } from "@/db/client";
+import { withBrand, withPlatformAdmin } from "@/db/client";
 import { files } from "@/db/schema";
 import {
   importContactsBatch,
@@ -45,11 +45,11 @@ export async function uploadContactsToBucket(
   const storageKey = `imports/${brandId}/${timestamp}-${safeName}`;
 
   try {
-    const [row] = await withTenant(brandId, (db) =>
+    const [row] = await withBrand(brandId, (db) =>
       db
         .insert(files)
         .values({
-          tenantId: brandId,
+          brandId: brandId,
           storageKey,
           mimeType: "text/csv",
           sizeBytes: file.size,
@@ -130,7 +130,7 @@ export async function listImportHistory(
   if (!adminUser) return { success: false, error: "Not authenticated" };
 
   try {
-    const rows = await withTenant(brandId, (db) =>
+    const rows = await withBrand(brandId, (db) =>
       db
         .select({
           storageKey: files.storageKey,
@@ -138,7 +138,7 @@ export async function listImportHistory(
           createdAt: files.createdAt,
         })
         .from(files)
-        .where(and(eq(files.tenantId, brandId), eq(files.purpose, "contact_import")))
+        .where(and(eq(files.brandId, brandId), eq(files.purpose, "contact_import")))
         .orderBy(desc(files.createdAt))
         .limit(limit),
     );