feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/time-tracking/index.ts

@@ -1,7 +1,6 @@
 "use server";
 
 import { getAdminUser } from "@/lib/admin-permissions";
-import { mockWorkers, mockTasks, mockTimeEntries } from "@/lib/mock-data";
 
 // TODO(migration): the time-tracking admin RPCs (get_time_tracking_workers,
 // create_time_worker, reset_time_worker_pin, update_time_worker,
@@ -13,15 +12,10 @@ import { mockWorkers, mockTasks, mockTimeEntries } from "@/lib/mock-data";
 // the underlying tables (`time_workers`, `time_tasks`, `time_logs`,
 // `time_tracking_settings`, `time_tracking_notification_log`) were
 // not carried over into the SaaS rebuild's `db/schema/`. The actions
-// below preserve the original signatures and return mock data when
-// `NEXT_PUBLIC_USE_MOCK_DATA === "true"`, but the real RPC paths now
-// return empty/empty-list results. To bring time tracking back, add
+// below return empty results. To bring time tracking back, add
 // the tables to `db/schema/` and re-implement against Drizzle. See
 // `actions/route-trace/lots.ts` for the same pattern.
 
-// Mock mode flag - only enabled when explicitly set
-const useMockData = process.env.NEXT_PUBLIC_USE_MOCK_DATA === "true";
-
 // ── Types ─────────────────────────────────────────────────────────────────────
 
 export type TimeWorker = {
@@ -69,21 +63,7 @@ export type TimeSummary = {
 
 // ── Workers ───────────────────────────────────────────────────────────────────
 
-export async function getTimeTrackingWorkers(brandId: string): Promise<TimeWorker[]> {
-  if (useMockData) {
-    return mockWorkers.map(w => ({
-      id: w.id,
-      brand_id: brandId,
-      name: w.name,
-      role: w.role,
-      lang: w.language,
-      pin: "0000",
-      active: w.is_active,
-      last_used_at: null,
-      created_at: new Date().toISOString(),
-      worker_number: null,
-    }));
-  }
+export async function getTimeTrackingWorkers(_brandId: string): Promise<TimeWorker[]> {
   // Time tracking tables not in SaaS rebuild — return empty list.
   return [];
 }
@@ -125,17 +105,7 @@ export async function deleteTimeWorker(_workerId: string): Promise<{ success: bo
 
 // ── Tasks ────────────────────────────────────────────────────────────────────
 
-export async function getTimeTrackingTasks(brandId: string, activeOnly = false): Promise<TimeTask[]> {
-  if (useMockData) {
-    return mockTasks.map(t => ({
-      id: t.id,
-      name: t.name_en,
-      name_es: t.name_es,
-      unit: t.unit,
-      active: true,
-      sort_order: t.sort_order,
-    }));
-  }
+export async function getTimeTrackingTasks(_brandId: string, _activeOnly = false): Promise<TimeTask[]> {
   return [];
 }
 
@@ -173,7 +143,7 @@ export async function deleteTimeTask(_taskId: string): Promise<{ success: boolea
 // ── Time Logs ─────────────────────────────────────────────────────────────────
 
 export async function getWorkerTimeLogs(
-  brandId: string,
+  _brandId: string,
   _options: {
     workerId?: string;
     taskId?: string;
@@ -183,30 +153,6 @@ export async function getWorkerTimeLogs(
     offset?: number;
   } = {}
 ): Promise<TimeLog[]> {
-  if (useMockData) {
-    // Filter by worker, task, date range
-    let entries = mockTimeEntries.filter(e => e.brand_id === brandId);
-    if (_options.workerId) entries = entries.filter(e => e.worker_id === _options.workerId);
-
-    return entries.map(e => {
-      const worker = mockWorkers.find(w => w.id === e.worker_id);
-      const task = mockTasks.find(t => t.id === e.task_id);
-      return {
-        id: e.id,
-        worker_id: e.worker_id,
-        worker_name: worker?.name ?? "Unknown",
-        task_id: e.task_id,
-        task_name: task?.name_en ?? "Unknown",
-        clock_in: `${e.date}T09:00:00Z`,
-        clock_out: `${e.date}T${9 + e.hours}:00:00Z`,
-        lunch_break_minutes: 0,
-        notes: null,
-        submitted_via: "web",
-        total_minutes: Math.round(e.hours * 60),
-        created_at: new Date().toISOString(),
-      };
-    });
-  }
   return [];
 }
 
@@ -230,43 +176,10 @@ export async function deleteWorkerTimeLog(_logId: string): Promise<{ success: bo
 }
 
 export async function getTimeTrackingSummary(
-  brandId: string,
+  _brandId: string,
   _start: string,
   _end: string
 ): Promise<TimeSummary> {
-  if (useMockData) {
-    const entries = mockTimeEntries.filter(e => e.brand_id === brandId);
-
-    // Calculate by worker
-    const workerMap = new Map<string, { id: string; name: string; total_hours: number; entry_count: number }>();
-    entries.forEach(e => {
-      const worker = mockWorkers.find(w => w.id === e.worker_id);
-      const existing = workerMap.get(e.worker_id) || { id: e.worker_id, name: worker?.name ?? "Unknown", total_hours: 0, entry_count: 0 };
-      existing.total_hours += e.hours;
-      existing.entry_count += 1;
-      workerMap.set(e.worker_id, existing);
-    });
-
-    // Calculate by task
-    const taskMap = new Map<string, { id: string; name: string; name_es: string | null; total_hours: number; entry_count: number }>();
-    entries.forEach(e => {
-      const task = mockTasks.find(t => t.id === e.task_id);
-      const existing = taskMap.get(e.task_id) || { id: e.task_id, name: task?.name_en ?? "Unknown", name_es: task?.name_es ?? null, total_hours: 0, entry_count: 0 };
-      existing.total_hours += e.hours;
-      existing.entry_count += 1;
-      taskMap.set(e.task_id, existing);
-    });
-
-    return {
-      by_worker: Array.from(workerMap.values()),
-      by_task: Array.from(taskMap.values()),
-      totals: {
-        entry_count: entries.length,
-        total_hours: entries.reduce((sum, e) => sum + e.hours, 0),
-        open_count: 0,
-      },
-    };
-  }
   return { by_worker: [], by_task: [], totals: { entry_count: 0, total_hours: 0, open_count: 0 } };
 }
 
@@ -291,27 +204,7 @@ export type TimeTrackingSettings = {
   brand_name: string;
 };
 
-export async function getTimeTrackingSettings(brandId: string): Promise<TimeTrackingSettings | null> {
-  if (useMockData) {
-    return {
-      id: "settings-mock",
-      brand_id: brandId,
-      pay_period_start_day: 0,
-      pay_period_length_days: 7,
-      daily_overtime_threshold: 8,
-      weekly_overtime_threshold: 40,
-      overtime_multiplier: 1.5,
-      overtime_notifications: true,
-      notification_emails: ["admin@tuxedocorn.com"],
-      notification_sms_numbers: [],
-      enable_daily_alerts: true,
-      enable_weekly_alerts: true,
-      daily_alert_threshold: 8,
-      weekly_alert_threshold: 40,
-      send_end_of_period_summary: true,
-      brand_name: "Tuxedo Corn",
-    };
-  }
+export async function getTimeTrackingSettings(_brandId: string): Promise<TimeTrackingSettings | null> {
   // Real RPC not in SaaS rebuild.
   return null;
 }
@@ -362,4 +255,4 @@ export async function getTimeTrackingNotificationLog(
   _limit = 100
 ): Promise<NotificationLogEntry[]> {
   return [];
-}
+}