feat: isolate all four portals with route groups + polished design system

Fix blank /org/login (and /admin/login): the guarded portal layout was
wrapping its own login route, rendering null when unauthenticated. Move
each portal's authed pages into a (authed)/(chapter) route group so login
pages live outside the guard.

Structure:
- app/(chapter)/* — chapter admin pages + guarded layout (was root-level)
- app/org/(authed)/* — org pages + guarded layout; /org/login now free
- app/admin/(authed)/* — admin pages + guarded layout; /admin/login free
- Root layout slimmed to providers only (no shared sidebar)
- Convert moved files' relative imports to @/app alias

Design system:
- PortalShell: shared sidebar shell (brand mark, themed active nav with
  accent bar, avatar dropdown user menu, loading skeletons)
- portal-theme.ts: per-portal theme tokens (violet/slate/blue/emerald)
- PortalLoginShell redesigned: two-column with gradient branding panel,
  dotted pattern, value-prop highlights, built-in back link
- New shadcn components: Avatar, DropdownMenu, Skeleton
- Move shared DraftCard to _components/draft-card.tsx (used by 2 portals)
- Portal selector: remove Super Admin card, icon tiles, hover lift
- All 4 login pages use react-hook-form + Zod + themed shell
- Member nav restored to full 11-section list with icons

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/_lib/sidebar.tsx

@@ -1,57 +0,0 @@
-'use client';
-
-import { usePathname, useRouter } from 'next/navigation';
-import { useEffect } from 'react';
-import { useAuth } from './auth-context';
-import { PortalNav } from '../_components/portal-nav';
-import {
-  Search, Users, MessageSquare, FileText, Settings, Bot,
-  LayoutDashboard, Building2, Server, Inbox,
-} from 'lucide-react';
-
-// Paths that render their own full-screen layout (no sidebar)
-const FULLSCREEN_PATHS = ['/', '/login', '/member-login', '/onboard', '/admin/login', '/org/login', '/org', '/admin', '/my'];
-
-const CHAPTER_NAV = [
-  { href: '/search', label: 'Search', icon: <Search /> },
-  { href: '/groups', label: 'Groups & Routes', icon: <Users /> },
-  { href: '/messages/pending', label: 'Pending', icon: <Inbox /> },
-  { href: '/drafts', label: 'AI Drafts', icon: <FileText /> },
-  { href: '/settings/rules', label: 'Rules', icon: <Settings /> },
-  { href: '/settings/bot', label: 'Bot', icon: <Bot /> },
-];
-
-export function Sidebar() {
-  const { admin, loading, logout } = useAuth();
-  const pathname = usePathname();
-  const router = useRouter();
-
-  const isFullscreen = FULLSCREEN_PATHS.some((p) =>
-    p === '/' ? pathname === '/' : pathname === p || pathname.startsWith(p + '/'),
-  );
-
-  useEffect(() => {
-    if (loading || isFullscreen) return;
-    if (!admin) router.replace(`/login?next=${encodeURIComponent(pathname)}`);
-  }, [loading, admin, pathname, router, isFullscreen]);
-
-  if (isFullscreen) return null;
-
-  if (loading) {
-    return (
-      <div className="w-56 shrink-0 border-r bg-sidebar animate-pulse" />
-    );
-  }
-
-  if (!admin) return null;
-
-  return (
-    <PortalNav
-      portalName="Chapter"
-      navItems={CHAPTER_NAV}
-      accentClass="text-blue-600"
-      user={{ email: admin.email, name: admin.name ?? undefined, role: admin.role }}
-      onLogout={() => { void logout(); router.replace('/login'); }}
-    />
-  );
-}