feat(db+auth): add pg pool, admin_users email/provider migration, refactor auth lookup

- Create src/lib/db.ts (shared pg.Pool, query/withTx helpers, server-only)
- Add @types/pg devDep
- Migration 204: add email, auth_provider, auth_subject columns to
  admin_users; backfill from auth.users; new upsert_admin_user accepts
  multi-provider args; new get_admin_user_for_session RPC resolves
  Auth.js session id (UUID or Google sub) to an admin row
- Refactor getAdminUser() to use pg + new RPC; auto-provisions on first
  Google sign-in using session.user.email
- Refactor updatePasswordAction to call update_user_password via pg
  (drops the Supabase REST hop)
- Delete orphaned src/actions/login.ts (replaced by auth-actions.ts)
- Drop remaining DEV_FORCE_UID references in users.ts; dev path now
  uses dev_session cookie (the only cookie the dev flow can set)
- Update AdminUser type: user_id is now string | null (Google users
  have no Supabase auth id); add email + auth_provider fields
- Fix downstream type errors: StopProductAssignment.callerUid accepts
  null; pickup.ts performedBy widens to string | null
- Bump vitest config, tests/, and other earlier cleanup changes

playwright.config.ts

@@ -1,6 +1,9 @@
 import { defineConfig, devices } from "@playwright/test";
 import path from "path";
 
+const LOCAL_BASE = process.env.PLAYWRIGHT_URL ?? "http://localhost:3000";
+const PROD_BASE = "https://route-commerce-platform.vercel.app";
+
 export default defineConfig({
   testDir: "./tests",
   fullyParallel: false,
@@ -9,16 +12,19 @@ export default defineConfig({
   workers: 1,
   reporter: "list",
   use: {
-    baseURL: "https://route-commerce-platform.vercel.app",
+    baseURL: LOCAL_BASE,
     trace: "on-first-retry",
   },
   projects: [
+    {
+      name: "local",
+      use: { ...devices["Desktop Chrome"], baseURL: LOCAL_BASE },
+    },
     {
       name: "production",
-      use: {
-        ...devices["Desktop Chrome"],
-        baseURL: "https://route-commerce-platform.vercel.app",
-      },
+      // `PLAYWRIGHT_PROD=1 npx playwright test` to run against the live site.
+      testMatch: /.*\.prod\.spec\.ts$/,
+      use: { ...devices["Desktop Chrome"], baseURL: PROD_BASE },
     },
   ],
 });