feat(portal): branded auth pages + legacy email styling + dev redirect override

- New PortalAuthShell component: blurred Port Nimara overhead background +
  circular logo + white rounded card, used by /portal/login,
  /portal/activate, /portal/reset-password
- New email/templates/portal-auth.ts: table-based, responsive (max-width
  600px / width 100%), matching the existing legacy inquiry templates;
  replaces the inline templates that lived in portal-auth.service
- EMAIL_REDIRECT_TO env override: when set, sendEmail routes every
  outbound message to that address regardless of recipient and tags the
  subject with "[redirected from <original>]". Dev/test safety net only;
  unset in production
- Portal password minimum length 12 → 9 (service + both API routes +
  client-side form)
- Dev helper script scripts/dev-trigger-portal-invite.ts: seeds a portal
  user against the first port-nimara client and uses EMAIL_REDIRECT_TO
  as the stored email so the tester can sign in with the address that
  received the activation mail

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/portal/password-set-form.tsx

@@ -8,6 +8,7 @@ import { CheckCircle2, Loader2 } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
+import { PortalAuthShell } from '@/components/portal/portal-auth-shell';
 
 interface PasswordSetFormProps {
   /** API endpoint that accepts `{ token, password }` and sets / resets the password. */
@@ -19,7 +20,7 @@ interface PasswordSetFormProps {
   submitLabel: string;
 }
 
-const MIN_LENGTH = 12;
+const MIN_LENGTH = 9;
 
 /**
  * Shared form used by both the activation and password-reset flows. The
@@ -74,8 +75,8 @@ export function PasswordSetForm({
 
   if (!token) {
     return (
-      <div className="min-h-screen flex items-center justify-center bg-gray-50 px-4">
-        <div className="w-full max-w-md text-center space-y-3">
+      <PortalAuthShell>
+        <div className="text-center space-y-3">
           <h1 className="text-xl font-semibold text-gray-900">Link is missing or invalid</h1>
           <p className="text-sm text-gray-500">
             Please use the link from the email we sent you. If the link is broken, request a new
@@ -83,19 +84,19 @@ export function PasswordSetForm({
           </p>
           <Link
             href="/portal/forgot-password"
-            className="inline-block text-sm text-[#1e2844] hover:underline"
+            className="inline-block text-sm text-[#007bff] hover:underline"
           >
             Request a new link
           </Link>
         </div>
-      </div>
+      </PortalAuthShell>
     );
   }
 
   if (done) {
     return (
-      <div className="min-h-screen flex items-center justify-center bg-gray-50 px-4">
-        <div className="w-full max-w-md text-center">
+      <PortalAuthShell>
+        <div className="text-center">
           <div className="inline-flex items-center justify-center w-14 h-14 rounded-full bg-green-50 mb-4">
             <CheckCircle2 className="h-7 w-7 text-green-600" />
           </div>
@@ -103,79 +104,75 @@ export function PasswordSetForm({
           <p className="text-gray-500 text-sm">{successDescription}</p>
           <Link
             href="/portal/login"
-            className="mt-6 inline-block text-sm text-[#1e2844] hover:underline"
+            className="mt-6 inline-block text-sm text-[#007bff] hover:underline"
           >
             Sign in
           </Link>
         </div>
-      </div>
+      </PortalAuthShell>
     );
   }
 
   return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50 px-4">
-      <div className="w-full max-w-sm">
-        <div className="bg-white rounded-lg border p-8 shadow-sm">
-          <div className="mb-6">
-            <h1 className="text-xl font-semibold text-gray-900">{title}</h1>
-            <p className="text-sm text-gray-500 mt-1">{description}</p>
-          </div>
-
-          <form onSubmit={handleSubmit} className="space-y-4">
-            <div className="space-y-1.5">
-              <Label htmlFor="password">New password</Label>
-              <Input
-                id="password"
-                type="password"
-                value={password}
-                onChange={(e) => setPassword(e.target.value)}
-                required
-                autoFocus
-                autoComplete="new-password"
-                minLength={MIN_LENGTH}
-                disabled={loading}
-              />
-              <p className="text-xs text-gray-500">At least {MIN_LENGTH} characters.</p>
-              {tooShort && (
-                <p className="text-xs text-red-600">
-                  Password must be at least {MIN_LENGTH} characters.
-                </p>
-              )}
-            </div>
-
-            <div className="space-y-1.5">
-              <Label htmlFor="confirm">Confirm password</Label>
-              <Input
-                id="confirm"
-                type="password"
-                value={confirm}
-                onChange={(e) => setConfirm(e.target.value)}
-                required
-                autoComplete="new-password"
-                disabled={loading}
-              />
-              {mismatch && <p className="text-xs text-red-600">Passwords don&apos;t match.</p>}
-            </div>
-
-            {error && <p className="text-sm text-red-600">{error}</p>}
-
-            <Button
-              type="submit"
-              className="w-full bg-[#1e2844] hover:bg-[#1e2844]/90 text-white"
-              disabled={!canSubmit}
-            >
-              {loading ? (
-                <>
-                  <Loader2 className="h-4 w-4 mr-2 animate-spin" />
-                  Saving…
-                </>
-              ) : (
-                submitLabel
-              )}
-            </Button>
-          </form>
-        </div>
+    <PortalAuthShell>
+      <div className="mb-6">
+        <h1 className="text-xl font-semibold text-gray-900">{title}</h1>
+        <p className="text-sm text-gray-500 mt-1">{description}</p>
       </div>
-    </div>
+
+      <form onSubmit={handleSubmit} className="space-y-4">
+        <div className="space-y-1.5">
+          <Label htmlFor="password">New password</Label>
+          <Input
+            id="password"
+            type="password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            required
+            autoFocus
+            autoComplete="new-password"
+            minLength={MIN_LENGTH}
+            disabled={loading}
+          />
+          <p className="text-xs text-gray-500">At least {MIN_LENGTH} characters.</p>
+          {tooShort && (
+            <p className="text-xs text-red-600">
+              Password must be at least {MIN_LENGTH} characters.
+            </p>
+          )}
+        </div>
+
+        <div className="space-y-1.5">
+          <Label htmlFor="confirm">Confirm password</Label>
+          <Input
+            id="confirm"
+            type="password"
+            value={confirm}
+            onChange={(e) => setConfirm(e.target.value)}
+            required
+            autoComplete="new-password"
+            disabled={loading}
+          />
+          {mismatch && <p className="text-xs text-red-600">Passwords don&apos;t match.</p>}
+        </div>
+
+        {error && <p className="text-sm text-red-600">{error}</p>}
+
+        <Button
+          type="submit"
+          className="w-full bg-[#007bff] hover:bg-[#0069d9] text-white"
+          disabled={!canSubmit}
+        >
+          {loading ? (
+            <>
+              <Loader2 className="h-4 w-4 mr-2 animate-spin" />
+              Saving…
+            </>
+          ) : (
+            submitLabel
+          )}
+        </Button>
+      </form>
+    </PortalAuthShell>
   );
 }