feat(app): Next.js 16 + Auth.js v5 portal skeleton

Next.js 16 + Auth.js v5 skeleton: host→slug middleware, tenant-context layout, OIDC sign-in flow against breakpilot-dev realm. 100% coverage on src/lib. Bumps next to 16.2.6 to clear trivy CVEs in 15.0.3.

src/app/[slug]/dashboard/page.tsx

@@ -0,0 +1,44 @@
+import { auth, signIn, signOut } from "@/auth";
+
+export default async function Dashboard({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}) {
+  const { slug } = await params;
+  const session = await auth();
+
+  if (!session) {
+    async function login() {
+      "use server";
+      await signIn("keycloak", { redirectTo: `/${slug}/dashboard` });
+    }
+    return (
+      <div>
+        <h1>Sign in to {slug}</h1>
+        <form action={login}>
+          <button type="submit">Sign in with Keycloak</button>
+        </form>
+      </div>
+    );
+  }
+
+  async function logout() {
+    "use server";
+    await signOut({ redirectTo: `/${slug}/dashboard` });
+  }
+
+  return (
+    <div>
+      <h1>Dashboard</h1>
+      <p>
+        Welcome, {session.user?.name ?? session.user?.email ?? "user"}. This is the{" "}
+        <code>{slug}</code> dashboard. Real product tiles, settings, billing — land
+        in M5.2 / M10.1.
+      </p>
+      <form action={logout} style={{ marginTop: 24 }}>
+        <button type="submit">Sign out</button>
+      </form>
+    </div>
+  );
+}