fix: admin auth for prod Neon Auth deployment

- getAdminUser now properly supports platform_admin with 0 brand links and loads full brand_ids
- createAdminUser action now inserts into admin_user_brands join table
- Admin layout surfaces the signed-in email on Access Denied
- AdminAccessDenied links to /login instead of dead-end /admin
- Main dashboard uses direct pool query instead of dead supabase shim
- Improved provision-admin.ts script for prod bootstrap (loads .env.production too)

src/components/admin/AdminAccessDenied.tsx

@@ -31,10 +31,16 @@ export default function AdminAccessDenied({
           </h1>
           <p className="mt-2 text-sm text-stone-500">{message}</p>
           <Link
-            href="/admin"
+            href="/login"
             className="mt-6 inline-flex items-center gap-2 rounded-xl bg-emerald-600 hover:bg-emerald-500 px-5 py-2.5 text-sm font-medium text-white transition-all shadow-sm"
           >
-            Back to Admin
+            Go to Login
+          </Link>
+          <Link
+            href="/"
+            className="mt-3 block text-sm text-stone-500 hover:text-stone-700 underline-offset-2 hover:underline"
+          >
+            Return to homepage
           </Link>
         </div>
       </div>