Make Mike runnable locally: Postgres + Auth.js + MinIO

Replace all supabase-js calls in backend/src/routes/projects.ts with
Drizzle ORM equivalents, add projectToWire/docToWire/folderToWire helpers
for snake_case wire shape preservation, and wrap every async handler in
try/catch. Drop the redundant _db shim arg from all checkProjectAccess
call sites. The listAllUsers() usage from P2-1 is preserved intact.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace all 30 supabase-js calls in documents.ts with Drizzle ORM queries.
Drop _db shim args from lib calls; preserve snake_case wire shapes via
inline mappers; wrap all handlers in try/catch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace all 18 supabase-js calls in workflows.ts with Drizzle ORM queries.
Add workflowToWire mapper for snake_case wire shape; drop _db shim args;
preserve listAllUsers() from P2-1; wrap all handlers in try/catch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Replace supabase.auth.getSession()+Bearer header pattern with
credentials:"include" across useFetchSingleDoc, useFetchDocxBytes,
and useDocumentVersions. Switch absolute NEXT_PUBLIC_API_BASE_URL
URLs to relative /api/backend/* so the Next.js rewrite forwards
the Auth.js session cookie automatically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace supabase.auth.getSession()+Bearer header pattern with
credentials:"include" in DocPanel (EditResolveButtons + DownloadButton),
DocxView (tagWIdsOnRenderedDom), EditCard (handle), and AssistantMessage
(BulkEditActions + DocDownloadBlock). Switch all absolute
NEXT_PUBLIC_API_BASE_URL URLs to relative /api/backend/* paths.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Replace the Bearer-token validation via Supabase with Auth.js's auth()
call. getUserFromRequest no longer takes a NextRequest argument since
Auth.js reads the session cookie internally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- git rm backend/src/lib/supabase.ts (no remaining importers)
- npm uninstall @supabase/supabase-js from backend
- npm uninstall @supabase/supabase-js @supabase/auth-helpers-nextjs @supabase/auth-js from frontend
- Add DEPRECATED header to backend/migrations/000_one_shot_schema.sql
- Update README.md: Supabase → Postgres/Drizzle setup instructions
- Update .serena/memories: reflect Plan 1 + Plan 2 both complete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Slim README to point at runbooks under docs/
- runbooks/: local-development, schema-changes, architecture, troubleshooting
- adr/: README + template + ADR-0001 capturing the Supabase removal decision
- deferred.md: consolidated tracker for known follow-ups (pre-prod hardening, code quality, auth features, operational gaps)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds a minio service (S3 API on :9000, console on :9001) and a
one-shot minio/mc sidecar that creates the 'mike' bucket on first
compose-up. Persistence via mike_minio_data named volume.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Use ${MINIO_ROOT_USER:-minioadmin} / ${MINIO_ROOT_PASSWORD:-minioadmin}
in both the minio env block and the minio-init entrypoint, matching
the postgres service convention. Adds a comment so contributors don't
mistake minio-init's Exited (0) for an error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Updates root and backend .env.example with MinIO endpoint and dev
credentials, plus the new R2_REGION and R2_FORCE_PATH_STYLE knobs.
Prod R2 config is unaffected - both new vars default to R2-friendly
values when unset in the storage client.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

R2_REGION (default 'auto') and R2_FORCE_PATH_STYLE (default false)
preserve current R2 prod behavior when unset, and let MinIO drop in
for local dev (region 'us-east-1', forcePathStyle true).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frontend/src/lib/storage.ts had zero importers - a leftover copy of
the backend module. Storage credentials only ever live on the server;
the frontend gets a signed URL from the backend and never holds keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The frontend storage.ts duplicate was removed in 2a1cc6f, leaving
@aws-sdk/client-s3 and @aws-sdk/s3-request-presigner unreferenced.
Uninstalling shrinks the dep tree and prevents accidental future
imports of S3 SDKs into client-bundled code.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- ADR-0002 captures the MinIO + provider-agnostic-storage decision,
  consequences, and alternatives, in the same shape as ADR-0001.
- local-development runbook: drop the "needs an R2 account" prereq,
  document the MinIO services in step 1, note that the pre-populated
  R2_* env block targets local MinIO out of the box.
- architecture runbook: storage line now mentions MinIO locally; add
  lib/storage.ts to the backend file map.
- deferred.md: pin MinIO image tags, R2_* → S3_* rename, frontend
  lint baseline, and the next/opennextjs peer-dep conflict that
  surfaced when uninstalling unused AWS SDK deps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Uninstall the 'resend' package from both backend and frontend.
  Zero source references in either tree; RESEND_API_KEY was env-only
  ceremony for a feature that doesn't exist yet (email is in
  docs/deferred.md as a future item).
- Drop RESEND_API_KEY from backend/.env.example and add a comment
  clarifying that LLM keys are optional for first-run exploration.
- Runbook updates:
  - Prerequisites: LLM keys marked optional with what works without one.
  - Step 1: note that db/init/01-extensions.sql enables pgcrypto on
    first Postgres boot.
  - Step 3: document --legacy-peer-deps requirement for frontend
    npm install (cross-references the deferred item).
  - Step 5: drop Resend from the fillables list, clarify LLM keys.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>