feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

src/actions/products/upload-image.ts

@@ -1,20 +1,14 @@
 "use server";
 
 import { getAdminUser } from "@/lib/admin-permissions";
-import { withTenant } from "@/db/client";
+import { withBrand } from "@/db/client";
 import { productImages } from "@/db/schema";
+import { uploadObject, BUCKETS } from "@/lib/storage";
 
 export type UploadProductImageResult =
   | { success: true; imageUrl: string }
   | { success: false; error: string };
 
-// TODO(migration): product images in the new SaaS schema live in the
-// `product_images` table (storage_key + position + alt_text) backed by
-// the `files` table. Supabase Storage is gone, so we no longer upload
-// to `/storage/v1/object/...` — that pathway is stubbed. Callers that
-// upload images should write to the `files` table via an S3-compatible
-// backend (still TODO). This stub persists the intended storage key as
-// a record so the UI can continue to render an image URL placeholder.
 export async function uploadProductImage(
   productId: string,
   file: File
@@ -33,16 +27,16 @@ export async function uploadProductImage(
   const ext = file.type.split("/")[1] === "jpeg" ? "jpg" : file.type.split("/")[1];
   const storageKey = `products/${productId}/${crypto.randomUUID()}.${ext}`;
 
-  // Without a configured object store, we cannot actually upload bytes.
-  // We still record the planned storage key in `product_images` so the
-  // schema-level FK + ordering are exercised. The actual upload will be
-  // re-introduced when the S3-compatible store lands.
-  if (productId === "__NEW__") {
-    return { success: false, error: "Object store not configured; cannot upload images yet" };
-  }
-
   try {
-    await withTenant(adminUser.brand_id ?? "__missing__", (db) =>
+    const buffer = Buffer.from(await file.arrayBuffer());
+    const imageUrl = await uploadObject({
+      bucket: BUCKETS.PRODUCTS,
+      key: storageKey,
+      body: buffer,
+      contentType: file.type,
+    });
+
+    await withBrand(adminUser.brand_id ?? "__missing__", (db) =>
       db.insert(productImages).values({
         productId,
         storageKey,
@@ -50,7 +44,8 @@ export async function uploadProductImage(
         altText: null,
       })
     );
-    return { success: true, imageUrl: `/storage/${storageKey}` };
+
+    return { success: true, imageUrl };
   } catch (err) {
     return { success: false, error: `Upload failed: ${err instanceof Error ? err.message : String(err)}` };
   }
@@ -66,7 +61,7 @@ export async function deleteProductImage(
   // from `product_images` for this product. The legacy `image_url` PATCH
   // pathway is gone (that column no longer exists on `products`).
   try {
-    await withTenant(adminUser.brand_id ?? "__missing__", (db) =>
+    await withBrand(adminUser.brand_id ?? "__missing__", (db) =>
       db.delete(productImages).where(eq(productImages.productId, productId))
     );
     return { success: true };