feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/stops/create-stop.ts

@@ -3,9 +3,6 @@
 import { revalidateTag } from "next/cache";
 import { getAdminUser } from "@/lib/admin-permissions";
 import { pool } from "@/lib/db";
-import { getMockTableData } from "@/lib/mock-data";
-
-const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
 
 export type CreateStopResult =
   | { success: true; id: string }
@@ -33,11 +30,6 @@ export async function createStop(
     return { success: false, error: "Not authorized for this brand" };
   }
 
-  if (useMockData) {
-    const mockStops = getMockTableData("stops") as Array<{ id: string }>;
-    return { success: true, id: `mock-stop-${Date.now()}` };
-  }
-
   // `admin_create_stop` is a SECURITY DEFINER RPC that bypasses the
   // block_stops_mutations RLS policy. It returns either {success,
   // stop_id} or {success:false, error}. Migration 202.

src/actions/stops/get-stop-details.ts

@@ -50,12 +50,6 @@ export async function getStopDetails(stopId: string): Promise<StopDetailsResult>
     return { success: false, error: "Not authorized" };
   }
 
-  const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
-
-  if (useMockData) {
-    return { success: false, error: "Stop not found" };
-  }
-
   // 1. Stop + brand — legacy schema, raw SQL (the Drizzle stops table
   //    maps to the new schema which doesn't have city/state/date/etc).
   const stopRes = await pool.query<StopDetail & { brand_name: string; brand_slug: string }>(

src/actions/stops/update-stop.ts

@@ -4,8 +4,6 @@ import { getAdminUser } from "@/lib/admin-permissions";
 import { pool } from "@/lib/db";
 import { logAuditEvent } from "@/actions/audit";
 
-const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
-
 export type UpdateStopResult =
   | { success: true }
   | { success: false; error: string };
@@ -33,10 +31,6 @@ export async function updateStop(
     return { success: false, error: "Not authorized for this brand" };
   }
 
-  if (useMockData) {
-    return { success: true };
-  }
-
   const slug = `${data.city.toLowerCase().replace(/\s+/g, "-")}-${data.date}`;
 
   // Direct UPDATE on the legacy stops table — the new-schema Drizzle