feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/components/admin/UsersPage.tsx

@@ -243,8 +243,8 @@ export default function UsersPage({ initialUsers, brands, currentUser, onUserCre
       } else {
         setPasswordModal({ email, tempPassword: null, loading: false, error: result.error ?? "Failed" });
       }
-    } catch (e: any) {
-      setPasswordModal({ email, tempPassword: null, loading: false, error: e?.message ?? "Error" });
+    } catch (e: unknown) {
+      setPasswordModal({ email, tempPassword: null, loading: false, error: e instanceof Error ? e.message : "Error" });
     }
   }
 
@@ -254,8 +254,8 @@ export default function UsersPage({ initialUsers, brands, currentUser, onUserCre
       const res = await setMustChangePassword(id);
       if (res.error) throw new Error(res.error);
       setUsers((prev) => prev.map((u) => u.id === id ? { ...u, must_change_password: true } : u));
-    } catch (e: any) {
-      setError(e?.message ?? "Failed to require password change");
+    } catch (e: unknown) {
+      setError(e instanceof Error ? e.message : "Failed to require password change");
     }
   }
 
@@ -267,9 +267,9 @@ export default function UsersPage({ initialUsers, brands, currentUser, onUserCre
       setResetLinkLoading(null);
       if (result.error) throw new Error(result.error);
       setError(null);
-    } catch (e: any) {
+    } catch (e: unknown) {
       setResetLinkLoading(null);
-      setError(e?.message ?? "Failed to send reset email");
+      setError(e instanceof Error ? e.message : "Failed to send reset email");
     }
   }