feat: isolate all four portals with route groups + polished design system

Fix blank /org/login (and /admin/login): the guarded portal layout was
wrapping its own login route, rendering null when unauthenticated. Move
each portal's authed pages into a (authed)/(chapter) route group so login
pages live outside the guard.

Structure:
- app/(chapter)/* — chapter admin pages + guarded layout (was root-level)
- app/org/(authed)/* — org pages + guarded layout; /org/login now free
- app/admin/(authed)/* — admin pages + guarded layout; /admin/login free
- Root layout slimmed to providers only (no shared sidebar)
- Convert moved files' relative imports to @/app alias

Design system:
- PortalShell: shared sidebar shell (brand mark, themed active nav with
  accent bar, avatar dropdown user menu, loading skeletons)
- portal-theme.ts: per-portal theme tokens (violet/slate/blue/emerald)
- PortalLoginShell redesigned: two-column with gradient branding panel,
  dotted pattern, value-prop highlights, built-in back link
- New shadcn components: Avatar, DropdownMenu, Skeleton
- Move shared DraftCard to _components/draft-card.tsx (used by 2 portals)
- Portal selector: remove Super Admin card, icon tiles, hover lift
- All 4 login pages use react-hook-form + Zod + themed shell
- Member nav restored to full 11-section list with icons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/(chapter)/layout.tsx

@@ -0,0 +1,40 @@
+'use client';
+
+import { useEffect } from 'react';
+import { usePathname, useRouter } from 'next/navigation';
+import { useAuth } from '@/app/_lib/auth-context';
+import { PortalShell } from '@/app/_components/portal-shell';
+import { Search, Users, Inbox, FileText, SlidersHorizontal, Bot } from 'lucide-react';
+
+const NAV = [
+  { href: '/search', label: 'Search', icon: <Search /> },
+  { href: '/groups', label: 'Groups & Routes', icon: <Users /> },
+  { href: '/messages/pending', label: 'Pending', icon: <Inbox /> },
+  { href: '/drafts', label: 'AI Drafts', icon: <FileText /> },
+  { href: '/settings/rules', label: 'Rules', icon: <SlidersHorizontal /> },
+  { href: '/settings/bot', label: 'Bot', icon: <Bot /> },
+];
+
+export default function ChapterLayout({ children }: { children: React.ReactNode }) {
+  const { admin, loading, logout } = useAuth();
+  const router = useRouter();
+  const pathname = usePathname();
+
+  useEffect(() => {
+    if (!loading && !admin) router.replace(`/login?next=${encodeURIComponent(pathname)}`);
+  }, [admin, loading, pathname, router]);
+
+  return (
+    <PortalShell
+      portalName="Chapter"
+      theme="blue"
+      navItems={NAV}
+      loading={loading}
+      authed={!!admin}
+      user={admin ? { email: admin.email, name: admin.name, role: admin.role, subtitle: admin.tenantName } : undefined}
+      onLogout={() => { void logout(); router.replace('/login'); }}
+    >
+      {children}
+    </PortalShell>
+  );
+}