fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/dashboard/creatives/page.tsx

@@ -0,0 +1,33 @@
+/**
+ * Stub: workflow de creatividades multi-tenant (upload, review, storage).
+ */
+import React from 'react';
+import { Image as ImageIcon, Upload } from 'lucide-react';
+
+export const revalidate = 0;
+
+export default function CreativesPage() {
+  return (
+    <div className="space-y-8">
+      <div>
+        <h2 className="text-2xl font-bold tracking-tight text-white">
+          Creatividades
+        </h2>
+        <p className="text-sm text-gray-400 mt-1">
+          Revisión cliente/agencia · roadmap 4Ventures Centro de Mando.
+        </p>
+      </div>
+      <div className="bg-[#111827] border border-dashed border-gray-700 rounded-xl p-12 text-center">
+        <ImageIcon className="w-10 h-10 text-gray-600 mx-auto mb-3" />
+        <p className="text-gray-300 font-medium">Próximo sprint</p>
+        <p className="text-xs text-gray-500 mt-2 max-w-md mx-auto">
+          Upload (JPEG/PNG/WebP/MP4/PDF · máx 25MB), estados draft → in_review →
+          approved/rejected, comentarios y storage por tenant (Supabase Storage).
+        </p>
+        <div className="mt-6 inline-flex items-center gap-2 text-amber-400/80 text-xs">
+          <Upload className="w-3.5 h-3.5" /> docs/CONVERGENCE.md
+        </div>
+      </div>
+    </div>
+  );
+}