fix(portal): full-screen overlay + redirect portal-only users

Portal layout: removed conflicting (portal)/layout.tsx that had
duplicate html/body tags. Portal page now uses fixed overlay
(z-[100]) that covers the entire screen including sidebar.

Middleware: portal-only users (dan.tiurbe) are automatically
redirected from any non-portal route to /portal. They can still
access /api/ and /auth/ routes normally.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/middleware.ts

@@ -12,8 +12,20 @@ export async function middleware(request: NextRequest) {
     secret: process.env.NEXTAUTH_SECRET,
   });
 
-  // Authenticated — allow through
+  // Authenticated — check for portal-only users
   if (token) {
+    const { pathname } = request.nextUrl;
+    // Portal-only users: redirect to /portal when accessing main app
+    const portalUsers = ["dan.tiurbe", "tiurbe"];
+    const tokenEmail = String(token.email ?? "").toLowerCase();
+    const tokenName = String(token.name ?? "").toLowerCase();
+    const isPortalUser = portalUsers.some(
+      (u) => tokenEmail.includes(u) || tokenName.includes(u),
+    );
+    if (isPortalUser && !pathname.startsWith("/portal") && !pathname.startsWith("/api/") && !pathname.startsWith("/auth/")) {
+      const baseUrl = process.env.NEXTAUTH_URL || "https://tools.beletage.ro";
+      return NextResponse.redirect(new URL("/portal", baseUrl));
+    }
     return NextResponse.next();
   }