Client portal — preview

Preview reads live from Meta. Auth + per-client isolation activate once Supabase is wired.