feat(storage): MinIO object storage, Neon Auth, Supabase removal

- Add MinIO/S3-compatible storage client (src/lib/storage.ts) with uploadObject,
  deleteObject, presigned URL helpers, and BUCKETS constant
- Wire product images, brand logos, and water log photos to MinIO via the
  new storage client
- Migrate forgot-password to Neon Auth (remove Supabase /auth/v1/recover call)
- Migrate send-scheduled cron to direct Postgres + Resend (remove Supabase Edge
  Function proxy)
- Add logoUrl to email types (OrderReceipt, Welcome, PasswordReset) and pass
  brand_settings.logo_url from all call sites
- Update email templates to use dynamic logoUrl instead of hardcoded Supabase
  bucket URLs
- Remove hardcoded Supabase URLs from TuxedoVideoHero, TuxedoAboutPage,
  TimeTrackingFieldClient; use brand_settings props + local public/ fallback
- Download brand logos (3) and tuxedo-hero.mp4 (36MB) from Supabase bucket to
  public/ for local development
- Add MinIO env vars to .env.example (endpoint, access key, secret, buckets)
- Fix TimeTrackingFieldClient to destructure logoUrl and brandAccent props
- Fix admin/users.ts logoUrl type (null → undefined for optional string)
- Remove stale sb- cookie from wholesale-auth
- Migrate tuxedo/about page to remove supabase import and use pool query for
  wholesale_settings lookup

supabase/migrations/.archived/045_extend_payment_settings_rpcs.sql

@@ -0,0 +1,53 @@
+-- Migration 045: Extend payment_settings RPCs for Square Sync
+-- Adds square_sync_enabled, square_inventory_mode, square_last_sync_at, square_last_sync_error
+-- to upsert_payment_settings and get_payment_settings
+
+CREATE OR REPLACE FUNCTION public.upsert_payment_settings(
+  p_brand_id                UUID,
+  p_provider                TEXT,
+  p_stripe_publishable_key   TEXT DEFAULT NULL,
+  p_stripe_secret_key       TEXT DEFAULT NULL,
+  p_square_access_token     TEXT DEFAULT NULL,
+  p_square_location_id      TEXT DEFAULT NULL,
+  p_square_sync_enabled     BOOLEAN DEFAULT NULL,
+  p_square_inventory_mode   TEXT DEFAULT NULL
+)
+RETURNS JSONB
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public
+AS $$
+BEGIN
+  INSERT INTO payment_settings (
+    brand_id, provider,
+    stripe_publishable_key, stripe_secret_key,
+    square_access_token, square_location_id,
+    square_sync_enabled, square_inventory_mode
+  )
+  VALUES (
+    p_brand_id, p_provider,
+    p_stripe_publishable_key, p_stripe_secret_key,
+    p_square_access_token, p_square_location_id,
+    COALESCE(p_square_sync_enabled, false),
+    COALESCE(p_square_inventory_mode, 'none')
+  )
+  ON CONFLICT (brand_id) DO UPDATE SET
+    provider = COALESCE(p_provider, payment_settings.provider),
+    stripe_publishable_key = COALESCE(p_stripe_publishable_key, payment_settings.stripe_publishable_key),
+    stripe_secret_key = COALESCE(p_stripe_secret_key, payment_settings.stripe_secret_key),
+    square_access_token = COALESCE(p_square_access_token, payment_settings.square_access_token),
+    square_location_id = COALESCE(p_square_location_id, payment_settings.square_location_id),
+    square_sync_enabled = COALESCE(p_square_sync_enabled, payment_settings.square_sync_enabled),
+    square_inventory_mode = COALESCE(p_square_inventory_mode, payment_settings.square_inventory_mode),
+    updated_at = now()
+  RETURNING jsonb_build_object(
+    'id', id,
+    'brand_id', brand_id,
+    'provider', provider,
+    'square_sync_enabled', square_sync_enabled,
+    'square_inventory_mode', square_inventory_mode,
+    'square_last_sync_at', square_last_sync_at,
+    'square_last_sync_error', square_last_sync_error
+  );
+END;
+$$;
+
+NOTIFY pgrst, 'reload schema';