Initial commit: Port Nimara CRM (Layers 0-4)

Full CRM rebuild with Next.js 15, TypeScript, Tailwind, Drizzle ORM,
PostgreSQL, Redis, BullMQ, MinIO, and Socket.io. Includes 461 source
files covering clients, berths, interests/pipeline, documents/EOI,
expenses/invoices, email, notifications, dashboard, admin, and
client portal. CI/CD via Gitea Actions with Docker builds.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/lib/portal/auth.ts

@@ -0,0 +1,35 @@
+import { SignJWT, jwtVerify } from 'jose';
+import { cookies } from 'next/headers';
+
+const PORTAL_SECRET = new TextEncoder().encode(process.env.BETTER_AUTH_SECRET);
+export const PORTAL_COOKIE = 'portal_session';
+
+export interface PortalSession {
+  clientId: string;
+  portId: string;
+  email: string;
+}
+
+export async function createPortalToken(session: PortalSession): Promise<string> {
+  return new SignJWT(session as unknown as Record<string, unknown>)
+    .setProtectedHeader({ alg: 'HS256' })
+    .setExpirationTime('24h')
+    .setIssuedAt()
+    .sign(PORTAL_SECRET);
+}
+
+export async function verifyPortalToken(token: string): Promise<PortalSession | null> {
+  try {
+    const { payload } = await jwtVerify(token, PORTAL_SECRET);
+    return payload as unknown as PortalSession;
+  } catch {
+    return null;
+  }
+}
+
+export async function getPortalSession(): Promise<PortalSession | null> {
+  const cookieStore = await cookies();
+  const token = cookieStore.get(PORTAL_COOKIE)?.value;
+  if (!token) return null;
+  return verifyPortalToken(token);
+}

src/lib/portal/helpers.ts

@@ -0,0 +1,20 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+import { getPortalSession, type PortalSession } from './auth';
+
+type PortalRouteHandler = (
+  req: NextRequest,
+  session: PortalSession,
+  params: Record<string, string>,
+) => Promise<NextResponse>;
+
+export function withPortalAuth(handler: PortalRouteHandler) {
+  return async (req: NextRequest, routeContext: { params: Promise<Record<string, string>> }) => {
+    const session = await getPortalSession();
+    if (!session) {
+      return NextResponse.json({ error: 'Portal authentication required' }, { status: 401 });
+    }
+    const params = await routeContext.params;
+    return handler(req, session, params);
+  };
+}