feat: isolate all four portals with route groups + polished design system

Fix blank /org/login (and /admin/login): the guarded portal layout was
wrapping its own login route, rendering null when unauthenticated. Move
each portal's authed pages into a (authed)/(chapter) route group so login
pages live outside the guard.

Structure:
- app/(chapter)/* — chapter admin pages + guarded layout (was root-level)
- app/org/(authed)/* — org pages + guarded layout; /org/login now free
- app/admin/(authed)/* — admin pages + guarded layout; /admin/login free
- Root layout slimmed to providers only (no shared sidebar)
- Convert moved files' relative imports to @/app alias

Design system:
- PortalShell: shared sidebar shell (brand mark, themed active nav with
  accent bar, avatar dropdown user menu, loading skeletons)
- portal-theme.ts: per-portal theme tokens (violet/slate/blue/emerald)
- PortalLoginShell redesigned: two-column with gradient branding panel,
  dotted pattern, value-prop highlights, built-in back link
- New shadcn components: Avatar, DropdownMenu, Skeleton
- Move shared DraftCard to _components/draft-card.tsx (used by 2 portals)
- Portal selector: remove Super Admin card, icon tiles, hover lift
- All 4 login pages use react-hook-form + Zod + themed shell
- Member nav restored to full 11-section list with icons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/(chapter)/settings/bot/page.tsx

@@ -0,0 +1,41 @@
+import { BotSettingsCard } from './BotSettingsCard';
+import { apiFetch } from '@/app/_lib/api';
+
+interface BotSummary {
+  id: string;
+  platform: string;
+  jid: string | null;
+  displayName: string | null;
+  status: 'ACTIVE' | 'DISCONNECTED' | 'BANNED' | 'PAIRING';
+  isBot: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+interface BotState {
+  bot: BotSummary | null;
+  shared: boolean;
+}
+
+export default async function BotSettingsPage() {
+  let state: BotState = { bot: null, shared: false };
+  try {
+    const res = await apiFetch('/admin/bot');
+    if (res.ok) {
+      state = (await res.json()) as BotState;
+    }
+  } catch {
+    state = { bot: null, shared: false };
+  }
+
+  return (
+    <div className="max-w-2xl">
+      <h1 className="text-xl font-semibold mb-6">Bot Settings</h1>
+      <p className="text-sm text-gray-600 mb-4">
+        TOWER runs on a dedicated WhatsApp number. Adding the bot to a group makes it eligible for
+        claim by any tenant admin. The bot number is hidden from members and the public web.
+      </p>
+      <BotSettingsCard initial={state} />
+    </div>
+  );
+}