fix: admin auth for prod Neon Auth deployment

- getAdminUser now properly supports platform_admin with 0 brand links and loads full brand_ids
- createAdminUser action now inserts into admin_user_brands join table
- Admin layout surfaces the signed-in email on Access Denied
- AdminAccessDenied links to /login instead of dead-end /admin
- Main dashboard uses direct pool query instead of dead supabase shim
- Improved provision-admin.ts script for prod bootstrap (loads .env.production too)

src/actions/admin/users.ts

@@ -211,6 +211,25 @@ export async function createAdminUser(input: CreateAdminUserInput): Promise<{ us
     );
     if (!rows[0]) return { user: null, error: "Insert returned no row" };
 
+    const newAdminId = String(rows[0].id);
+
+    // Ensure the admin_user_brands link exists for brand-scoped roles.
+    // (Platform admins created without a chosen brand may have 0 links and still
+    // get access via role; getAdminUser allows this.)
+    if (input.brand_id) {
+      try {
+        await query(
+          `INSERT INTO admin_user_brands (admin_user_id, brand_id)
+           VALUES ($1, $2)
+           ON CONFLICT (admin_user_id, brand_id) DO NOTHING`,
+          [newAdminId, input.brand_id],
+        );
+      } catch (linkErr) {
+        console.error("[createAdminUser] Failed to create admin_user_brands link:", linkErr);
+        // Non-fatal — the user row exists; a platform admin can link manually.
+      }
+    }
+
     await sendWelcomeEmailSafe({
       to: input.email,
       name: input.display_name ?? input.email.split("@")[0],