real Supabase schema + data loaded; cleanup synthesized placeholder

Major changes:
- Drop synthesized base schema (supabase/synthesized/000_base_schema.sql) —
  real pg_dump from Supabase is now the source of truth
- Switch better-auth from better-auth/minimal to better-auth (full)
- Add localhost:9000 (MinIO) to next.config images allowlist
- Add .data/, bin/ to gitignore (local runtime artifacts)
- Ignore supabase/captured/ (regenerate from Supabase as needed)

DB state after dump:
- 65 real tables (vs 70 synthesized)
- 252 functions
- 5 brands: Tuxedo Corn, Indian River Direct + 3 test brands
- 3 admin users, 1 communication template, 7 brand features

Pooler URL: aws-1-us-east-1.pooler.supabase.com:5432
  user: postgres.wnzkhezyhnfzhkhiflrp
  (NOT aws-0 — that one doesn't know this project)

.env.example

@@ -1,9 +1,9 @@
 # --- Self-hosted Postgres (Docker) ---
 POSTGRES_USER=routecommerce
-POSTGRES_PASSWORD=lay7yqM3fHNvwpfjb4tvz7M3kimopyrSHQF24vsuGUM
+POSTGRES_PASSWORD=routecommerce_dev_password
 POSTGRES_DB=route_commerce
 # Used by the app and push-migrations.js to talk to the local DB
-DATABASE_URL=postgresql://routecommerce:lay7yqM3fHNvwpfjb4tvz7M3kimopyrSHQF24vsuGUM@127.0.0.1:5432/route_commerce?schema=public
+DATABASE_URL=postgresql://routecommerce:routecommerce_dev_password@127.0.0.1:5432/route_commerce?schema=public
 
 # --- PostgREST (REST API — replaces Supabase REST) ---
 # Server actions call `${NEXT_PUBLIC_SUPABASE_URL}/rest/v1/rpc/...`
@@ -25,7 +25,7 @@ STORAGE_BUCKET_PREFIX=
 NEXT_PUBLIC_STORAGE_BASE_URL=http://localhost:9000
 
 # --- Better Auth ---
-BETTER_AUTH_SECRET=change-me-32-char-random-string-here-pls-32chars
+BETTER_AUTH_SECRET=REPLACE_ME_WITH_OPENSSL_RAND_HEX_32
 BETTER_AUTH_URL=http://localhost:3000
 NEXT_PUBLIC_BETTER_AUTH_URL=http://localhost:3000