feat(selfhost): complete Supabase removal migration

Phase 1 — Pattern library
- Add src/lib/api.ts (typed PostgREST client, anon-key)
- Add src/lib/svc-fetch.ts (service-role fetch + PostgREST client)
- Add src/lib/db-types.ts (Database generic, RowOf helper)
- Add src/lib/auth-admin.ts (better-auth admin wrappers: createUser, listUsers, removeUser, requestPasswordReset, validateSession)

Phase 2 — Server action migration
- Migrate all 67 server actions off @supabase/supabase-js to svcApi/svcRpc
- Replace service.auth.admin.* with authAdmin.* (better-auth)
- Replace publicApi.auth.* with authAdmin.* (better-auth)
- Add typed single() null guards + nullable column fallbacks

Phase 3 — Delete mock data + debug routes
- Remove if(useMockData) branches from 7 files (-226 lines)
- Delete src/lib/mock-data.ts (no longer referenced)
- Delete 7 debug API routes (debug-admin-users, debug-auth, debug-cookie, debug-env, debug-get-admin-users, debug-hello, debug-me)

Phase 4 — Hard cut
- Delete src/lib/supabase.ts (orphan — no importers)
- Delete src/app/api/supabase + src/app/api/supabase-test routes
- Remove @supabase/ssr + @supabase/supabase-js from package.json
- Rename env vars: NEXT_PUBLIC_SUPABASE_URL → NEXT_PUBLIC_API_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY → NEXT_PUBLIC_API_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY → POSTGREST_SERVICE_KEY

Phase 5 — Verify
- npx tsc --noEmit: 0 errors
- npm run lint: 0 new errors from migration (104 pre-existing errors unrelated)
- npm run build: same failure mode as main worktree (PostgREST-dependent prerender), no regression

Net: 158 files changed, +1640 / -1903 lines (-263 net)

src/app/tuxedo/page.tsx

@@ -12,7 +12,7 @@ import StorefrontHeader from "@/components/storefront/StorefrontHeader";
 import StorefrontFooter from "@/components/storefront/StorefrontFooter";
 import BrandStylesProvider from "@/components/storefront/BrandStylesProvider";
 import { ScrollReveal, ParallaxLayer, FadeOnScroll } from "@/components/ui/ScrollAnimations";
-import { supabase } from "@/lib/supabase";
+import { api } from "@/lib/api";
 import { getBrandSettingsPublic } from "@/actions/brand-settings";
 import { gsap } from "gsap";
 import { ScrollTrigger } from "gsap/ScrollTrigger";
@@ -449,7 +449,7 @@ export default function TuxedoPage() {
       const slug = "tuxedo";
 
       const [brandResult, settingsResult] = await Promise.all([
-        supabase.from("brands").select("*").eq("slug", slug).single(),
+        api.from("brands").select("*").eq("slug", slug).single(),
         getBrandSettingsPublic(slug),
       ]);
 
@@ -484,10 +484,10 @@ export default function TuxedoPage() {
       }
 
       if (brandData?.id) {
-        const [{ data: stopsData }, { data: productsData }] = await Promise.all([
-          supabase.from("stops").select("*").eq("brand_id", brandData.id).eq("active", true),
-          supabase.from("products").select("*").eq("brand_id", brandData.id).eq("active", true),
-        ]);
+        const [{ data: stopsData }, { data: productsData }] = (await Promise.all([
+          api.from("stops").select("*").eq("brand_id", brandData.id).eq("active", true),
+          api.from("products").select("*").eq("brand_id", brandData.id).eq("active", true),
+        ])) as any;
         setStops(stopsData ?? []);
         setProducts(productsData ?? []);
       }