fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/RUNBOOK.md

@@ -0,0 +1,33 @@
+# Runbook — Centro de Mando 4Ventures
+
+Operador: `marketing@4ventures.es`
+
+## Health
+
+```bash
+curl -sf https://app.4ventures.es/api/health
+./scripts/smoke.sh https://app.4ventures.es
+```
+
+## Deploy (Dokploy)
+
+1. Push a `main` en Gitea `Marketing/4ventures-client-portal`.
+2. Dokploy rebuild del servicio `app`.
+3. Env: `NEXT_PUBLIC_SUPABASE_*`, `SUPABASE_SERVICE_ROLE_KEY`, `ANTHROPIC_API_KEY`.
+4. Smoke: `/login` → KPIs → simulador → chat.
+
+## Alta cliente
+
+UI `/dashboard/agencia` (roles admin/team) o RPC `provision_client`.
+
+## Atribución
+
+```html
+<script src="https://app.4ventures.es/_4v_attr.js" defer></script>
+```
+
+`POST https://n8n-agencia.4ventures.es/webhook/lead-inbound`
+
+## Incidentes
+
+Ver `SECURITY.md`.