fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

sql/rls_checklist.sql

@@ -0,0 +1,27 @@
+-- RLS checklist — run in Supabase SQL editor as postgres
+-- Goal: prove tenant isolation (no cross-tenant reads)
+
+-- 1) List tables missing RLS
+select c.relname as table_name, c.relrowsecurity as rls_enabled
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = 'public' and c.relkind = 'r'
+order by 1;
+
+-- 2) Expected: tenants, users, leads, deals, ad_daily, documents,
+--    document_chunks, agent_runs, targets, kpi_weekly (view) …
+-- Each business table: ALTER TABLE … ENABLE ROW LEVEL SECURITY;
+
+-- 3) Example policy pattern (adapt column names):
+-- create policy tenant_select on public.leads
+--   for select using (
+--     tenant_id::text = coalesce(
+--       auth.jwt() -> 'app_metadata' ->> 'tenant_id',
+--       auth.jwt() -> 'user_metadata' ->> 'tenant_id'
+--     )
+--   );
+
+-- 4) Negative test: login as client A, select count(*) from leads
+--    where tenant_id = '<tenant_B>'; must be 0.
+
+-- 5) Service role bypasses RLS — never expose to browser.