feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/communications/stop-blast.ts

@@ -2,7 +2,7 @@
 
 import { and, eq, sql, SQL } from "drizzle-orm";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { withTenant } from "@/db/client";
+import { withBrand } from "@/db/client";
 import { customers, orders, campaigns, emailTemplates } from "@/db/schema";
 
 export type StopBlastResult =
@@ -37,8 +37,8 @@ export async function sendStopBlast(params: {
   }
 
   try {
-    const conds: SQL[] = [eq(customers.tenantId, params.brandId)];
-    const recipientRows = await withTenant(params.brandId, async (db) => {
+    const conds: SQL[] = [eq(customers.brandId, params.brandId)];
+    const recipientRows = await withBrand(params.brandId, async (db) => {
       // Distinct customers from the tenant's recent orders.
       const orderCustomers = await db
         .selectDistinct({ id: customers.id })
@@ -46,7 +46,7 @@ export async function sendStopBlast(params: {
         .innerJoin(orders, eq(orders.customerId, customers.id))
         .where(
           and(
-            eq(orders.tenantId, params.brandId),
+            eq(orders.brandId, params.brandId),
             params.channel === "sms"
               ? eq(customers.smsOptIn, true)
               : params.channel === "email"
@@ -81,11 +81,11 @@ export async function sendStopBlast(params: {
     // Persist a draft campaign for traceability. No template link — the
     // stop-blast content is supplied inline and not yet modeled.
     const bodyHtml = `<p style="white-space:pre-wrap">${escapeHtml(params.body)}</p>`;
-    const inserted = await withTenant(params.brandId, async (db) => {
+    const inserted = await withBrand(params.brandId, async (db) => {
       const template = await db
         .insert(emailTemplates)
         .values({
-          tenantId: params.brandId,
+          brandId: params.brandId,
           name: `Stop blast ${new Date().toISOString()}`,
           subject: params.subject ?? "Pickup update",
           bodyHtml,
@@ -96,7 +96,7 @@ export async function sendStopBlast(params: {
       const campaign = await db
         .insert(campaigns)
         .values({
-          tenantId: params.brandId,
+          brandId: params.brandId,
           name: `Stop blast ${new Date().toISOString()}`,
           templateId: tplId,
           status: "sent",