selfhost: route brand assets through /storage/ rewrite

Download 3 Tuxedo brand logos from Supabase Storage to local MinIO and
point the DB at portable /storage/... paths. Add a Next.js rewrite in
next.config.ts that proxies /storage/* to the configured MinIO endpoint.

Why: Next.js's image optimizer refuses to fetch upstream images whose
hostname resolves to a private IP. Local MinIO lives on 127.0.0.1, so
direct URLs (e.g. http://localhost:9000/...) get blocked with
"upstream image resolved to private ip [::1,127.0.0.1]".

The rewrite keeps URLs same-origin in the browser, so the optimizer's
private-IP check is bypassed. For production, set STORAGE_PUBLIC_URL to
the public MinIO endpoint and the same DB values work without change.

Also fix the same pattern in 3 client-rendered components that
hardcoded publicUrl(BUCKETS.BRAND_LOGOS, ...) for fallback assets:
- TuxedoVideoHero (hero video + Olathe Sweet dark logo)
- TimeTrackingFieldClient (field UI logo)
- tuxedo/about (about page logo)

email-service.ts keeps publicUrl() because Resend fetches URLs
server-side from its own network.

Documented the workflow and gotchas in docs/SUPABASE_DUMP_GUIDE.md.

next.config.ts

@@ -106,8 +106,18 @@ const nextConfig: NextConfig = {
 
   // Rewrites for API proxy
   async rewrites() {
+    // Storage proxy: /storage/* -> MinIO at the same path
+    // Lets brand assets and product images use portable relative URLs
+    // (e.g. /storage/brand-logos/<id>/logo.png) in the DB, with Next.js
+    // proxying to whichever MinIO endpoint is configured for the environment.
+    // Avoids the next/image "upstream resolved to private ip" block on
+    // localhost MinIO by keeping the upstream fetch on the server side.
+    const storageBase = process.env.STORAGE_PUBLIC_URL || "http://localhost:9000";
     return [
-      // Add any necessary rewrites here
+      {
+        source: "/storage/:path*",
+        destination: `${storageBase}/:path*`,
+      },
     ];
   },