fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/smoke.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+BASE="${1:-https://app.4ventures.es}"
+echo "== health =="
+curl -sf "$BASE/api/health" | tee /tmp/4v-health.json
+echo
+node -e "const j=require('/tmp/4v-health.json'); if(!j.ok) process.exit(1)"
+echo "== login =="
+code=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/login")
+test "$code" = "200"
+echo "== chat unauthorized =="
+code=$(curl -s -o /dev/null -w "%{http_code}" -X POST "$BASE/api/chat" -H 'Content-Type: application/json' -d '{"message":"hola"}')
+test "$code" = "401"
+echo "Smoke OK · $BASE"