feat: Subscriber portal web — login, dashboard, invoices, tickets (FIBEROPS-243-246)

- New route group app/(portal)/ separate from admin app
- Minimal portal layout with FiberOps branding, no admin nav
- portal-auth-store.ts: Zustand store with portal_token in localStorage
- portal-api.ts: Axios instance using portal_token + X-Tenant-Slug
- Login page: tenant slug + account number + password form
- Dashboard: account info, subscription details, balance due, quick links
- Invoices page: table with status badges (PAID/PARTIAL/OVERDUE/SENT)
- Tickets page: ticket list + New Ticket modal (POST /portal/tickets)
- Client detail profile tab: Portal Access Enabled/Disabled field
- portalAccessEnabled added to Client type

lib/portal-api.ts

@@ -0,0 +1,33 @@
+import axios from 'axios';
+
+const portalApi = axios.create({
+  baseURL: process.env.NEXT_PUBLIC_API_URL || 'https://fiberops-api.juankibin.space',
+});
+
+portalApi.interceptors.request.use((config) => {
+  if (typeof window !== 'undefined') {
+    const token = localStorage.getItem('portal_token');
+    const authRaw = localStorage.getItem('portal_auth');
+    const tenantSlug = authRaw ? JSON.parse(authRaw)?.state?.tenantSlug : null;
+    if (token) config.headers.Authorization = `Bearer ${token}`;
+    if (tenantSlug) {
+      config.headers['x-tenant-slug'] = tenantSlug;
+      config.headers['X-Tenant-Slug'] = tenantSlug;
+    }
+  }
+  return config;
+});
+
+portalApi.interceptors.response.use(
+  (res) => res,
+  (err) => {
+    if (err.response?.status === 401 && typeof window !== 'undefined') {
+      localStorage.removeItem('portal_token');
+      localStorage.removeItem('portal_auth');
+      window.location.href = '/portal/login';
+    }
+    return Promise.reject(err);
+  }
+);
+
+export default portalApi;