SEC: portal server actions ungated - unauthenticated read of client queue

ENAMEL-18 enamel Done urgent

portalPen: staff triage surface (read, answer, assign, resolve tickets)

ENAMEL-20 enamel Done high

Access-request form: /solicitar-acceso is a dead end, accessIssueReports never written

ENAMEL-21 enamel Done high

Portal: accept 'venus' as a portal appKey scope tag + grant Puia client under venus

ENAMEL-17 enamel Done high

Split shared app.bypass_immutable GUC per-guard (enamel half)

ENAMEL-13 enamel Done high

Scaffold bare Next.js app + push first commit to empty GitHub repo

ENAMEL-5 enamel Done high

App shell: no navigation, no sign-out, single-branch redirector

ENAMEL-23 enamel Done

Schema-qualify 62 unqualified references in 24 function bodies (enamel_025)

ENAMEL-15 enamel Done

pg_temp search_path hardening across all enamel functions (A2 + 022 + 023A)

ENAMEL-14 enamel Done

Verify coder-enamel-cc Vercel build+runtime-log read before Class-A self-PTD floor is enforceable

ENAMEL-9 enamel Done

sync fouba-institucional.md into enamel checkout + git-add it

ENAMEL-10 enamel Done

P1 router-rebind: codify Class-S→solo-default / Class-A→full-team into enamel project docs

ENAMEL-6 enamel Done

FoUBA shared institutional reference — solo-enamel content assembly + commons trigger-line

ENAMEL-4 enamel Done

Rename portal module to portalPen + give the empty state a next action

ENAMEL-25 enamel Done low