feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

tests/smoke.spec.ts

@@ -34,16 +34,25 @@ test.describe("Smoke Tests", () => {
     expect(page.url()).toMatch(/\/login(\?|$)/);
   });
 
-  test("Login page renders the Google CTA (or 'not configured' notice)", async ({ page }) => {
+  test("Login page renders the sign-in form", async ({ page }) => {
     await page.goto(`${BASE}/login`);
+    // Check for email/password form (the main login method)
+    const hasEmail = await page.getByLabel(/email/i).isVisible().catch(() => false);
+    const hasPassword = await page.getByLabel(/password/i).isVisible().catch(() => false);
+    const hasSignInButton = await page.getByRole("button", { name: /sign in/i }).isVisible().catch(() => false);
+    
+    // OR check for Google button (alternative method)
     const hasGoogle = await page
       .getByRole("button", { name: /continue with google/i })
       .isVisible()
       .catch(() => false);
+    
+    // OR check for "not configured" message
     const hasSetup = await page
       .getByText(/Google sign-in is not configured/i)
       .isVisible()
       .catch(() => false);
-    expect(hasGoogle || hasSetup).toBe(true);
+    
+    expect(hasEmail || hasPassword || hasSignInButton || hasGoogle || hasSetup).toBe(true);
   });
 });