feat: portal selector home page + remove self-serve signup

Replace the home page with a portal selector showing three access paths:
- Organisation Portal → /org/login
- Chapter Portal → /login
- Member Portal → /member-login

Remove /signup and its BFF route — tenants are now only created by org
owners through the org portal or assigned by super admins. Self-serve
community creation is no longer supported.

Update sidebar to bypass auth guard for / (exact match) without
accidentally matching all paths via startsWith.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web/app/_lib/sidebar.tsx

@@ -22,7 +22,7 @@ const SUPER_ADMIN_LINKS = [
   { href: '/admin/drafts', label: 'AI Drafts' },
 ];
 
-const PUBLIC_PATHS = ['/login', '/signup', '/onboard', '/member-login'];
+const PUBLIC_PATHS = ['/login', '/onboard', '/member-login'];
 const ADMIN_PATHS = ['/admin'];
 const MEMBER_PATHS = ['/my'];
 const ORG_PATHS = ['/org'];
@@ -43,6 +43,7 @@ export function Sidebar() {
 
   useEffect(() => {
     if (loading) return;
+    if (pathname === '/') return;
     if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) return;
     if (ADMIN_PATHS.some((p) => pathname.startsWith(p))) return;
     if (MEMBER_PATHS.some((p) => pathname.startsWith(p))) return;
@@ -52,7 +53,7 @@ export function Sidebar() {
     }
   }, [loading, admin, pathname, router]);
 
-  if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) {
+  if (pathname === '/' || PUBLIC_PATHS.some((p) => pathname.startsWith(p))) {
     return (
       <nav className="w-52 shrink-0 bg-white border-r border-gray-200 p-4">
         <span className="font-bold text-base">TOWER</span>

apps/web/app/api/auth/signup/route.ts

@@ -1,19 +0,0 @@
-import { getApiBaseUrl, jsonResponse } from '../../../_lib/api';
-
-export const dynamic = 'force-dynamic';
-
-export async function POST(req: Request): Promise<Response> {
-  const body = await req.json();
-  const upstream = await fetch(`${getApiBaseUrl()}/auth/signup`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-    body: JSON.stringify(body),
-    cache: 'no-store',
-  });
-  const payload = await upstream.json();
-  if (!upstream.ok) return jsonResponse(payload, upstream.status);
-  const token: string | undefined = payload?.token;
-  if (!token) return jsonResponse({ message: 'Signup response missing token' }, 502);
-  const cookieValue = `tower_token=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${60 * 60 * 24 * 7}`;
-  return jsonResponse({ admin: payload.admin }, 200, { 'Set-Cookie': cookieValue });
-}

apps/web/app/page.tsx

@@ -1,25 +1,63 @@
 import Link from 'next/link';
 
+const PORTALS = [
+  {
+    href: '/org/login',
+    title: 'Organisation Portal',
+    description: 'For org-level admins managing multiple chapters and org-wide rules.',
+    badge: 'Org Admin',
+    color: 'hover:border-violet-400',
+    badgeColor: 'bg-violet-100 text-violet-700',
+  },
+  {
+    href: '/login',
+    title: 'Chapter Portal',
+    description: 'For chapter admins approving messages, managing groups and routing rules.',
+    badge: 'Chapter Admin',
+    color: 'hover:border-blue-400',
+    badgeColor: 'bg-blue-100 text-blue-700',
+  },
+  {
+    href: '/member-login',
+    title: 'Member Portal',
+    description: 'For community members to view digests, manage privacy and explore the directory.',
+    badge: 'Member',
+    color: 'hover:border-emerald-400',
+    badgeColor: 'bg-emerald-100 text-emerald-700',
+  },
+];
+
 export default function Home() {
   return (
-    <div className="flex flex-col gap-6 max-w-xl">
-      <h1 className="text-3xl font-bold tracking-tight">Insignia TOWER</h1>
-      <p className="text-gray-500">Community Knowledge Infrastructure Platform</p>
-      <div className="flex gap-4">
+    <div className="min-h-screen flex items-center justify-center bg-gray-50 p-6">
+      <div className="w-full max-w-lg">
+        <div className="mb-10 text-center">
+          <h1 className="text-3xl font-bold tracking-tight text-gray-900">TOWER</h1>
+          <p className="text-gray-500 mt-2 text-sm">Community Knowledge Infrastructure Platform</p>
+        </div>
+
+        <div className="flex flex-col gap-4">
+          {PORTALS.map((p) => (
             <Link
-          href="/search"
-          className="flex-1 rounded-xl border border-gray-200 bg-white p-5 hover:border-blue-400 transition-colors"
+              key={p.href}
+              href={p.href}
+              className={`bg-white rounded-2xl border border-gray-200 p-6 flex items-start gap-5 transition-colors ${p.color}`}
             >
-          <h2 className="font-semibold mb-1">Search</h2>
-          <p className="text-sm text-gray-500">Full-text search of approved messages</p>
-        </Link>
-        <Link
-          href="/groups"
-          className="flex-1 rounded-xl border border-gray-200 bg-white p-5 hover:border-blue-400 transition-colors"
-        >
-          <h2 className="font-semibold mb-1">Groups</h2>
-          <p className="text-sm text-gray-500">Manage groups and sync routes</p>
+              <div className="flex-1">
+                <div className="flex items-center gap-2 mb-1">
+                  <h2 className="font-semibold text-gray-900">{p.title}</h2>
+                  <span className={`text-xs font-medium px-2 py-0.5 rounded-full ${p.badgeColor}`}>{p.badge}</span>
+                </div>
+                <p className="text-sm text-gray-500">{p.description}</p>
+              </div>
+              <span className="text-gray-300 text-xl mt-0.5">›</span>
             </Link>
+          ))}
+        </div>
+
+        <p className="text-center text-xs text-gray-400 mt-8">
+          Administrators are provisioned by your organisation — contact your org admin if you need access.
+        </p>
       </div>
     </div>
   );

apps/web/app/signup/SignupForm.tsx

@@ -1,142 +0,0 @@
-'use client';
-
-import { useRouter } from 'next/navigation';
-import { useState } from 'react';
-import { useAuth } from '../_lib/auth-context';
-
-function slugify(input: string): string {
-  return input
-    .toLowerCase()
-    .trim()
-    .replace(/[^a-z0-9]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 40);
-}
-
-export function SignupForm({ redirect }: { redirect?: string }) {
-  const router = useRouter();
-  const { refresh } = useAuth();
-  const [tenantName, setTenantName] = useState('');
-  const [tenantSlug, setTenantSlug] = useState('');
-  const [slugTouched, setSlugTouched] = useState(false);
-  const [email, setEmail] = useState('');
-  const [password, setPassword] = useState('');
-  const [confirmPassword, setConfirmPassword] = useState('');
-  const [submitting, setSubmitting] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const computedSlug = slugify(tenantName);
-  const effectiveSlug = slugTouched ? tenantSlug : computedSlug;
-
-  async function onSubmit(e: React.FormEvent) {
-    e.preventDefault();
-    setError(null);
-    if (password !== confirmPassword) {
-      setError('Passwords do not match');
-      return;
-    }
-    if (effectiveSlug.length < 2) {
-      setError('Tenant name must produce a valid slug (lowercase letters, digits, dashes)');
-      return;
-    }
-    setSubmitting(true);
-    try {
-      const res = await fetch('/api/auth/signup', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ tenantName, tenantSlug: effectiveSlug, email, password }),
-        credentials: 'include',
-      });
-      if (!res.ok) {
-        const data = (await res.json().catch(() => ({}))) as { message?: string };
-        const messages = Array.isArray((data as { message?: unknown }).message)
-          ? ((data as unknown as { message: string[] }).message.join(', '))
-          : data.message;
-        setError(messages ?? 'Signup failed');
-        return;
-      }
-      await refresh();
-      router.push(redirect || '/');
-    } finally {
-      setSubmitting(false);
-    }
-  }
-
-  return (
-    <form onSubmit={onSubmit} className="space-y-3">
-      <label className="block text-sm">
-        <span className="font-medium">Community / organization name</span>
-        <input
-          type="text"
-          value={tenantName}
-          onChange={(e) => setTenantName(e.target.value)}
-          placeholder="Delhi Traders"
-          required
-          className="mt-1 w-full border rounded px-3 py-2"
-        />
-      </label>
-      <label className="block text-sm">
-        <span className="font-medium">URL slug</span>
-        <input
-          type="text"
-          value={effectiveSlug}
-          onChange={(e) => {
-            setSlugTouched(true);
-            setTenantSlug(slugify(e.target.value));
-          }}
-          placeholder="delhi"
-          required
-          className="mt-1 w-full border rounded px-3 py-2 font-mono text-sm"
-        />
-        <span className="block text-xs text-gray-500 mt-1">
-          Lowercase letters, digits, dashes. 2–40 chars.
-        </span>
-      </label>
-      <label className="block text-sm">
-        <span className="font-medium">Your email</span>
-        <input
-          type="email"
-          value={email}
-          onChange={(e) => setEmail(e.target.value)}
-          placeholder="you@example.com"
-          required
-          className="mt-1 w-full border rounded px-3 py-2"
-        />
-      </label>
-      <label className="block text-sm">
-        <span className="font-medium">Password</span>
-        <input
-          type="password"
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-          placeholder="At least 8 characters"
-          minLength={8}
-          required
-          className="mt-1 w-full border rounded px-3 py-2"
-        />
-      </label>
-      <label className="block text-sm">
-        <span className="font-medium">Confirm password</span>
-        <input
-          type="password"
-          value={confirmPassword}
-          onChange={(e) => setConfirmPassword(e.target.value)}
-          minLength={8}
-          required
-          className="mt-1 w-full border rounded px-3 py-2"
-        />
-      </label>
-      {error && <p className="text-sm text-red-600">{error}</p>}
-      <button
-        type="submit"
-        disabled={submitting}
-        className="w-full px-4 py-2 bg-blue-600 text-white rounded disabled:opacity-50"
-      >
-        {submitting ? 'Creating account…' : 'Create community'}
-      </button>
-      <p className="text-xs text-gray-500 text-center">
-        You&apos;ll be the first OWNER. You can invite others from settings later.
-      </p>
-    </form>
-  );
-}

apps/web/app/signup/page.tsx

@@ -1,24 +0,0 @@
-import { SignupForm } from './SignupForm';
-
-export default async function SignupPage({
-  searchParams,
-}: {
-  searchParams: Promise<{ redirect?: string }>;
-}) {
-  const { redirect } = await searchParams;
-  return (
-    <div className="min-h-screen flex items-center justify-center bg-gray-50 p-4">
-      <div className="w-full max-w-md bg-white rounded shadow p-6">
-        <h1 className="text-xl font-semibold mb-1">Create your TOWER community</h1>
-        <p className="text-sm text-gray-500 mb-6">
-          Already have an account?{' '}
-          <a href="/login" className="text-blue-600 hover:underline">
-            Sign in
-          </a>
-          .
-        </p>
-        <SignupForm redirect={redirect} />
-      </div>
-    </div>
-  );
-}