feat: agency portfolio with per-client integrations hub

Admin home lists tenants, alerts, and connection health; header
selector enables superadmin context; Meta/GA4/GSC/GTM/CRM/email
slots live per tenant (manual status until OAuth).

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/creatives/route.ts

@@ -1,5 +1,27 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { cookies } from 'next/headers';
 import { createClient } from '@/lib/supabase/server';
+import {
+  VIEW_TENANT_COOKIE,
+  homeTenantId,
+  isAgencyRole,
+  serviceHeaders,
+  supabaseUrl,
+  userRole,
+} from '@/lib/agency';
+
+async function resolveTenantId(user: {
+  app_metadata?: Record<string, unknown>;
+  user_metadata?: Record<string, unknown>;
+}): Promise<{ tenantId: string | null; viaView: boolean }> {
+  const role = userRole(user);
+  const cookieStore = await cookies();
+  const viewId = cookieStore.get(VIEW_TENANT_COOKIE)?.value || null;
+  if (isAgencyRole(role) && viewId) {
+    return { tenantId: viewId, viaView: true };
+  }
+  return { tenantId: homeTenantId(user), viaView: false };
+}
 
 export async function GET() {
   const supabase = await createClient();
@@ -10,13 +32,39 @@ export async function GET() {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
+  const { tenantId, viaView } = await resolveTenantId(user);
+
+  if (viaView && tenantId) {
+    const headers = serviceHeaders();
+    if (!headers) {
+      return NextResponse.json(
+        { creatives: [], warning: 'Service role required for superadmin view' },
+        { status: 200 }
+      );
+    }
+    const r = await fetch(
+      `${supabaseUrl()}/rest/v1/creatives?tenant_id=eq.${encodeURIComponent(tenantId)}&select=id,title,status,mime_type,bytes,created_at,updated_at&order=updated_at.desc`,
+      { headers, cache: 'no-store' }
+    );
+    if (!r.ok) {
+      return NextResponse.json({
+        creatives: [],
+        warning: await r.text(),
+        viewTenantId: tenantId,
+      });
+    }
+    return NextResponse.json({
+      creatives: await r.json(),
+      viewTenantId: tenantId,
+    });
+  }
+
   const { data, error } = await supabase
     .from('creatives')
     .select('id,title,status,mime_type,bytes,created_at,updated_at')
     .order('updated_at', { ascending: false });
 
   if (error) {
-    // Table may not exist yet — soft message for pre-migration
     return NextResponse.json(
       { creatives: [], warning: error.message },
       { status: 200 }
@@ -35,8 +83,7 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
   }
 
-  const tenantId =
-    user.app_metadata?.tenant_id || user.user_metadata?.tenant_id || null;
+  const { tenantId, viaView } = await resolveTenantId(user);
   if (!tenantId) {
     return NextResponse.json({ error: 'Usuario sin tenant_id' }, { status: 403 });
   }
@@ -47,14 +94,43 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: 'title requerido' }, { status: 400 });
   }
 
+  const row = {
+    tenant_id: tenantId,
+    title,
+    status: 'draft',
+    created_by: user.id,
+  };
+
+  if (viaView) {
+    const headers = serviceHeaders();
+    if (!headers) {
+      return NextResponse.json(
+        { error: 'Service role required' },
+        { status: 503 }
+      );
+    }
+    const r = await fetch(`${supabaseUrl()}/rest/v1/creatives`, {
+      method: 'POST',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+        Prefer: 'return=representation',
+      },
+      body: JSON.stringify(row),
+    });
+    if (!r.ok) {
+      return NextResponse.json({ error: await r.text() }, { status: 500 });
+    }
+    const data = await r.json();
+    return NextResponse.json(
+      { creative: Array.isArray(data) ? data[0] : data },
+      { status: 201 }
+    );
+  }
+
   const { data, error } = await supabase
     .from('creatives')
-    .insert({
-      tenant_id: tenantId,
-      title,
-      status: 'draft',
-      created_by: user.id,
-    })
+    .insert(row)
     .select('id,title,status,created_at')
     .single();