feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/shipping/fedex-rates.ts

@@ -165,10 +165,10 @@ export async function getFedExRates(
   // meaningful error rather than silently call the API with junk.
   const { rows: orderRows } = await pool.query<{
     id: string;
-    tenant_id: string | null;
+    brand_id: string | null;
     status: string;
   }>(
-    `SELECT id::text AS id, tenant_id::text AS tenant_id, status
+    `SELECT id::text AS id, brand_id::text AS brand_id, status
      FROM orders WHERE id = $1 LIMIT 1`,
     [orderId]
   );
@@ -176,10 +176,10 @@ export async function getFedExRates(
   if (!order) return { success: false, error: "Order not found" };
 
   // The order's brand is the source of truth. Validate the admin has access.
-  if (order.tenant_id) {
-    try { assertBrandAccess(adminUser, order.tenant_id); } catch { return { success: false, error: "Brand access denied" }; }
+  if (order.brand_id) {
+    try { assertBrandAccess(adminUser, order.brand_id); } catch { return { success: false, error: "Brand access denied" }; }
   }
-  const effectiveBrandId = order.tenant_id ?? adminUser.brand_id ?? null;
+  const effectiveBrandId = order.brand_id ?? adminUser.brand_id ?? null;
   if (!effectiveBrandId) {
     return { success: false, error: "Brand required for shipping" };
   }