fix: admin auth for prod Neon Auth deployment

- getAdminUser now properly supports platform_admin with 0 brand links and loads full brand_ids
- createAdminUser action now inserts into admin_user_brands join table
- Admin layout surfaces the signed-in email on Access Denied
- AdminAccessDenied links to /login instead of dead-end /admin
- Main dashboard uses direct pool query instead of dead supabase shim
- Improved provision-admin.ts script for prod bootstrap (loads .env.production too)

src/app/admin/layout.tsx

@@ -4,6 +4,7 @@ import { getAdminUser } from "@/lib/admin-permissions";
 import { getActiveBrandId } from "@/lib/brand-scope";
 import { listBrandsForAdmin } from "@/actions/brands";
 import { redirect } from "next/navigation";
+import { getSession } from "@/lib/auth";
 import "@/styles/admin-design-system.css";
 import { ToastProvider } from "@/components/admin/Toast";
 import { ToastContainer } from "@/components/admin/ToastContainer";
@@ -47,13 +48,25 @@ export default async function AdminLayout({ children }: { children: React.ReactN
     );
   }
 
-  // Not authenticated
+  // Not authenticated / not provisioned
   if (!adminUser) {
+    // Best-effort: surface the Neon Auth identity so the user (or support) knows
+    // which account was checked. getAdminUser already logged details.
+    let attemptedEmail: string | null = null;
+    try {
+      const { data: session } = await getSession();
+      attemptedEmail = session?.user?.email ?? null;
+    } catch {
+      // ignore
+    }
+    const message = attemptedEmail
+      ? `Your account (${attemptedEmail}) does not have admin access. Contact a platform administrator to be provisioned.`
+      : "Your account does not have admin access.";
     return (
       <ToastProviderWrapper>
         <AdminSidebar userRole={null} />
         <div className="min-h-screen lg:pl-60 admin-section" style={{ backgroundColor: "var(--admin-bg)" }}>
-          <AdminAccessDenied message="Your account does not have admin access." />
+          <AdminAccessDenied message={message} />
         </div>
       </ToastProviderWrapper>
     );