feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/app/admin/time-tracking/page.tsx

@@ -1,6 +1,5 @@
 import TimeTrackingAdminPanel from "@/components/admin/TimeTrackingAdminPanel";
 import { getAdminUser } from "@/lib/admin-permissions";
-import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
 import { PageHeader } from "@/components/admin/design-system";
 
@@ -11,16 +10,9 @@ export const dynamic = "force-dynamic";
 
 export default async function AdminTimeTrackingPage() {
   const adminUser = await getAdminUser();
-  
-  // Dev session bypass for platform admin
+
   if (!adminUser) {
-    const cookieStore = await cookies();
-    const devSession = cookieStore.get("dev_session")?.value;
-    if (devSession === "platform_admin" || devSession === "brand_admin") {
-      // Allow access in dev mode
-    } else {
-      redirect("/login");
-    }
+    redirect("/login");
   }
 
   const isPlatformAdmin = adminUser?.role === "platform_admin";
@@ -45,4 +37,4 @@ export default async function AdminTimeTrackingPage() {
       </div>
     </div>
   );
-}
+}