feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/app/change-password/ChangePasswordForm.tsx

@@ -2,8 +2,7 @@
 
 import { useState } from "react";
 import { useRouter } from "next/navigation";
-import { updatePasswordAction } from "@/actions/admin/password";
-import { logUserActivity } from "@/actions/admin/audit";
+import Link from "next/link";
 
 export default function ChangePasswordForm({ userId }: { userId: string }) {
   const router = useRouter();
@@ -26,22 +25,28 @@ export default function ChangePasswordForm({ userId }: { userId: string }) {
     }
 
     setLoading(true);
-    const result = await updatePasswordAction(password);
-    setLoading(false);
 
-    if (result.error) {
-      setError(result.error);
-      return;
+    try {
+      const res = await fetch("/api/auth/change-password", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ userId, password }),
+      });
+
+      const data = await res.json();
+
+      if (!res.ok || data.error) {
+        setError(data.message ?? data.error ?? "Failed to update password.");
+        setLoading(false);
+        return;
+      }
+
+      router.push("/admin");
+      router.refresh();
+    } catch {
+      setError("An unexpected error occurred. Please try again.");
+      setLoading(false);
     }
-
-    logUserActivity({
-      user_id: userId,
-      activity_type: "password_change",
-      details: {},
-    }).catch(() => {});
-
-    router.push("/admin");
-    router.refresh();
   }
 
   return (
@@ -113,6 +118,15 @@ export default function ChangePasswordForm({ userId }: { userId: string }) {
               {loading ? "Updating..." : "Update Password"}
             </button>
           </form>
+
+          <div className="mt-4 border-t border-zinc-800 pt-4">
+            <Link
+              href="/logout"
+              className="block text-center text-sm text-zinc-500 hover:text-zinc-300 transition-colors"
+            >
+              Sign out instead
+            </Link>
+          </div>
         </div>
       </div>
     </main>

src/app/change-password/page.tsx

@@ -3,8 +3,7 @@
 import { useState } from "react";
 import { useRouter } from "next/navigation";
 import Link from "next/link";
-import { updatePasswordAction } from "@/actions/admin/password";
-import { logUserActivity } from "@/actions/admin/audit";
+import { getCurrentUserId } from "@/actions/admin/password";
 
 export default function ChangePasswordPage() {
   const router = useRouter();
@@ -27,23 +26,28 @@ export default function ChangePasswordPage() {
     }
 
     setLoading(true);
-    const result = await updatePasswordAction(password);
-    setLoading(false);
 
-    if (result.error) {
-      setError(result.error);
-      return;
+    try {
+      const res = await fetch("/api/auth/change-password", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password }),
+      });
+
+      const data = await res.json();
+
+      if (!res.ok || data.error) {
+        setError(data.message ?? data.error ?? "Failed to update password.");
+        setLoading(false);
+        return;
+      }
+
+      router.push("/admin");
+      router.refresh();
+    } catch {
+      setError("An unexpected error occurred. Please try again.");
+      setLoading(false);
     }
-
-    // Audit log (best-effort — the password change itself was the source of truth)
-    logUserActivity({
-      user_id: result.userId ?? "unknown",
-      activity_type: "password_change",
-      details: {},
-    }).catch(() => {});
-
-    router.push("/admin");
-    router.refresh();
   }
 
   return (