Remove stale [slug] storefront routes, fix dev-login server action crash

- Remove src/app/{tuxedo,indian-river-direct}/stops/[slug] routes that
  collide with [id] routes (caused Next to refuse to start) and still
  imported the removed @supabase/* client. Active code lives under [id].
- In devLoginAction, wrap getSession() in try/catch so a missing /
  unreachable Neon Auth config doesn't 500 the action and silently
  bounce the user back to /login.
- Add allowedDevOrigins config (env-driven via NEXT_ALLOWED_DEV_ORIGINS)
  so the dev server accepts HMR / dev-resource requests from LAN IPs.

next.config.ts

@@ -159,6 +159,15 @@ const nextConfig: NextConfig = {
       fullUrl: process.env.NODE_ENV === "development",
     },
   },
+
+  // Allow cross-origin requests to dev resources (HMR, dev manifest, etc.)
+  // from non-localhost hosts (e.g. LAN IPs, dev tunnels). Read from
+  // `NEXT_ALLOWED_DEV_ORIGINS` as a comma-separated list. Empty in production.
+  allowedDevOrigins: process.env.NEXT_ALLOWED_DEV_ORIGINS
+    ? process.env.NEXT_ALLOWED_DEV_ORIGINS.split(",")
+        .map((s) => s.trim())
+        .filter(Boolean)
+    : [],
 };
 
 export default nextConfig;