feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

supabase/migrations/.archived/036_user_activity_logs.sql

@@ -0,0 +1,36 @@
+-- Migration: 036_user_activity_logs
+-- Tracks per-user activities: logins, password changes, profile updates
+
+CREATE TABLE IF NOT EXISTS user_activity_logs (
+  id             UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id        UUID NOT NULL,
+  activity_type  TEXT NOT NULL,  -- 'login' | 'logout' | 'password_change' | 'profile_update' | 'email_change'
+  details        JSONB DEFAULT '{}',
+  ip_address     TEXT,
+  user_agent     TEXT,
+  created_at     TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Index for fast per-user log lookups
+CREATE INDEX IF NOT EXISTS idx_user_activity_logs_user_id ON user_activity_logs(user_id);
+-- Index for time-based queries per user
+CREATE INDEX IF NOT EXISTS idx_user_activity_logs_created_at ON user_activity_logs(created_at DESC);
+
+-- RLS: user can read own logs; platform_admin can read all
+ALTER TABLE user_activity_logs ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "user_read_own_activity_logs" ON user_activity_logs
+  FOR SELECT USING (auth.uid() = user_id);
+
+CREATE POLICY "platform_admin_read_all_user_activity_logs" ON user_activity_logs
+  FOR SELECT USING (
+    EXISTS (
+      SELECT 1 FROM admin_users au
+      WHERE au.user_id = auth.uid()
+        AND au.role = 'platform_admin'
+    )
+  );
+
+-- Any authenticated user can insert their own log entries
+CREATE POLICY "user_insert_own_activity_logs" ON user_activity_logs
+  FOR INSERT WITH CHECK (auth.uid() = user_id);