fix(security): harden auth, tenant scoping, and scrub secrets

Require session on APIs, scope KPIs/activos/simulate to the user tenant, strip real JWTs from .env.example, and add health/smoke/docs for 4Ventures ops.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/dashboard/layout.tsx

@@ -71,6 +71,13 @@ export default async function DashboardLayout({
               <FolderGit2 className="w-4 h-4 text-blue-400" />
               Biblioteca de Activos
             </Link>
+            <Link
+              href="/dashboard/creatives"
+              className="flex items-center gap-3 px-3 py-2.5 rounded-lg text-sm font-medium text-gray-300 hover:text-white hover:bg-gray-800/60 transition-all"
+            >
+              <FolderGit2 className="w-4 h-4 text-orange-400" />
+              Creatividades
+            </Link>
             <Link
               href="/dashboard/asistente"
               className="flex items-center gap-3 px-3 py-2.5 rounded-lg text-sm font-medium text-gray-300 hover:text-white hover:bg-gray-800/60 transition-all"