feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

supabase/migrations/.archived/146_sitemap_stops_rpc.sql

@@ -0,0 +1,32 @@
+-- Migration: 146_sitemap_stops_rpc.sql
+-- Description: RPC to fetch active stops with brand slug for sitemap generation
+
+CREATE OR REPLACE FUNCTION get_active_stops_with_brand()
+RETURNS TABLE (
+  slug TEXT,
+  brand_slug TEXT,
+  last_modified TIMESTAMPTZ
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+BEGIN
+  RETURN QUERY
+  SELECT
+    s.slug,
+    b.slug AS brand_slug,
+    COALESCE(s.updated_at, s.created_at) AS last_modified
+  FROM stops s
+  INNER JOIN brands b ON s.brand_id = b.id
+  WHERE s.active = true
+    AND s.slug IS NOT NULL
+    AND b.slug IN ('tuxedo', 'indian-river-direct')
+  ORDER BY s.updated_at DESC;
+END;
+$$;
+
+-- Grant execute to anon and service role
+GRANT EXECUTE ON FUNCTION get_active_stops_with_brand() TO anon;
+GRANT EXECUTE ON FUNCTION get_active_stops_with_brand() TO service_role;
+GRANT EXECUTE ON FUNCTION get_active_stops_with_brand() TO authenticated;