fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/health/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from 'next/server';
+
+/** Liveness for Dokploy / uptime — no secrets. */
+export async function GET() {
+  const hasAnon = Boolean(process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY?.trim());
+  const hasUrl = Boolean(process.env.NEXT_PUBLIC_SUPABASE_URL?.trim());
+  const hasService = Boolean(process.env.SUPABASE_SERVICE_ROLE_KEY?.trim());
+  const ok = hasAnon && hasUrl;
+  return NextResponse.json(
+    {
+      ok,
+      service: '4ventures-client-portal',
+      supabaseConfigured: hasUrl && hasAnon,
+      serviceRoleConfigured: hasService,
+      ts: new Date().toISOString(),
+    },
+    { status: ok ? 200 : 503 }
+  );
+}