feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/app/api/auth/reset-password/route.ts

@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from "next/server";
+import { resetPassword } from "@/lib/auth";
+
+interface ResetPasswordBody {
+  password: string;
+}
+
+export async function POST(req: NextRequest) {
+  let body: ResetPasswordBody;
+
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: "Invalid request body." }, { status: 400 });
+  }
+
+  const { password } = body;
+
+  if (!password || password.length < 8) {
+    return NextResponse.json(
+      { error: "Password must be at least 8 characters." },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const result = await resetPassword({
+      newPassword: password,
+    });
+
+    if (result.error) {
+      console.error("[auth/reset-password] Reset failed:", result.error);
+      return NextResponse.json(
+        {
+          error: result.error.code ?? "ResetFailed",
+          message: result.error.message ?? "Failed to reset password. The link may have expired.",
+        },
+        { status: 400 }
+      );
+    }
+
+    console.log("[auth/reset-password] Password reset successful");
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    console.error("[auth/reset-password] Unexpected error:", err);
+    return NextResponse.json(
+      { error: "InternalError", message: "An unexpected error occurred." },
+      { status: 500 }
+    );
+  }
+}