Initial commit: Port Nimara CRM (Layers 0-4)

Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/app/(portal)/layout.tsx

@@ -0,0 +1,61 @@
+import type { Metadata } from 'next';
+import { redirect } from 'next/navigation';
+
+import { getPortalSession } from '@/lib/portal/auth';
+import { getPortalDashboard } from '@/lib/services/portal.service';
+import { PortalHeader } from '@/components/portal/portal-header';
+import { PortalNav } from '@/components/portal/portal-nav';
+
+export const metadata: Metadata = {
+  title: {
+    default: 'Client Portal',
+    template: '%s | Client Portal',
+  },
+};
+
+const PUBLIC_PORTAL_PATHS = ['/portal/login', '/portal/verify'];
+
+export default async function PortalLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  // This layout wraps all portal routes including login/verify
+  // We can't easily check pathname in a server layout, so we attempt
+  // to get the session and pass it down — login/verify pages handle their own
+  // redirect logic independently.
+  const session = await getPortalSession().catch(() => null);
+
+  // For authenticated routes we need client info for the header.
+  // If session is absent, children (login/verify pages) handle their own redirect.
+  let clientName = '';
+  let portName = 'Client Portal';
+  let portLogoUrl: string | null = null;
+
+  if (session) {
+    const dashboard = await getPortalDashboard(session.clientId, session.portId).catch(() => null);
+    if (dashboard) {
+      clientName = dashboard.client.fullName;
+      portName = dashboard.port.name;
+      portLogoUrl = dashboard.port.logoUrl;
+    }
+  }
+
+  return (
+    <div className="min-h-screen bg-gray-50">
+      {session && (
+        <>
+          <PortalHeader
+            portName={portName}
+            portLogoUrl={portLogoUrl}
+            clientName={clientName}
+          />
+          <PortalNav />
+        </>
+      )}
+      <main className={session ? 'max-w-5xl mx-auto px-4 sm:px-6 py-8' : ''}>
+        {children}
+      </main>
+    </div>
+  );
+}