Tenant portal

Set TENANT_PORTAL_PASSWORD in .env. Real per-user auth lands when Resend is wired.