fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1,3 +1,39 @@
-# 4ventures-client-portal
+# 4Ventures — Centro de Mando del Cliente
 
-Centro de Mando del Cliente — Next.js 15 App Router + Supabase + shadcn/ui
+Portal ejecutivo multi-tenant · **source of truth** para `app.4ventures.es`.
+
+Operador: `marketing@4ventures.es`
+
+Next.js 15 + Supabase + n8n (agentes/webhooks fuera de este repo).
+
+## Quick start
+
+```bash
+cp .env.example .env.local   # keys rotadas — nunca las del PDF histórico
+npm install
+npm run dev
+```
+
+Health: `GET /api/health`
+
+## Docs
+
+- [docs/IDENTITY.md](./docs/IDENTITY.md)
+- [SECURITY.md](./SECURITY.md)
+- [docs/CONVERGENCE.md](./docs/CONVERGENCE.md)
+- [docs/RUNBOOK.md](./docs/RUNBOOK.md)
+- [sql/rls_checklist.sql](./sql/rls_checklist.sql)
+
+## Rutas
+
+| Path | Uso |
+|------|-----|
+| `/login` | Supabase Auth |
+| `/dashboard/kpis` | KPIs |
+| `/dashboard/estrategia` | Targets + simulador |
+| `/dashboard/activos` | Docs aprobados (RLS) |
+| `/dashboard/creatives` | Creatividades (en curso) |
+| `/dashboard/asistente` | Chat RPC |
+| `/dashboard/agencia` | Cross-tenant (admin/team) |
+| `/dashboard/calendario` | Editorial RRSS |
+| `/_4v_attr.js` | Script atribución |