feat(app): Next.js 16 + Auth.js v5 portal skeleton

Next.js 16 + Auth.js v5 skeleton: host→slug middleware, tenant-context layout, OIDC sign-in flow against breakpilot-dev realm. 100% coverage on src/lib. Bumps next to 16.2.6 to clear trivy CVEs in 15.0.3.

src/lib/tenant-registry.ts

@@ -0,0 +1,29 @@
+// Tenant Registry client — fetches tenant data from the Go service.
+// Skeleton-mode: read-only by-slug lookup. The portal middleware uses this
+// to resolve `<slug>.localhost:3000` → tenant context before rendering.
+
+export type Tenant = {
+  id: string;
+  slug: string;
+  name: string;
+  status: "active" | "trial" | "frozen" | "archived" | "demo";
+  plan: "starter" | "professional" | "enterprise";
+  products: string[];
+  created_at: string;
+};
+
+function baseUrl(): string {
+  return process.env.TENANT_REGISTRY_URL ?? "http://localhost:8080";
+}
+
+export async function fetchTenantBySlug(slug: string): Promise<Tenant | null> {
+  const res = await fetch(`${baseUrl()}/v1/tenants/by-slug/${encodeURIComponent(slug)}`, {
+    headers: { accept: "application/json" },
+    cache: "no-store",
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    throw new Error(`tenant-registry: ${res.status} ${res.statusText}`);
+  }
+  return (await res.json()) as Tenant;
+}