feat: agency portfolio with per-client integrations hub

Admin home lists tenants, alerts, and connection health; header
selector enables superadmin context; Meta/GA4/GSC/GTM/CRM/email
slots live per tenant (manual status until OAuth).

Co-authored-by: Cursor <cursoragent@cursor.com>

src/middleware.ts

@@ -77,8 +77,12 @@ export async function middleware(req: NextRequest) {
   }
 
   if (user && path === '/login') {
+    const role = user?.app_metadata?.role || user?.user_metadata?.role || 'client';
     const dashboardUrl = req.nextUrl.clone();
-    dashboardUrl.pathname = '/dashboard/kpis';
+    dashboardUrl.pathname =
+      role === 'admin' || role === 'team'
+        ? '/dashboard/agencia'
+        : '/dashboard/kpis';
     return withSecurityHeaders(NextResponse.redirect(dashboardUrl));
   }