App shell: no navigation, no sign-out, single-branch redirector

The (protected) layout renders a header with the app name and the user name and NOTHING else: no nav, no section links, no sign-out control. A user who lands on /portal cannot reach any other section and cannot log out. / is a role-aware redirector with exactly one branch (client -> /portal) and a fallback telling the user they have no sections. As sections land (staff triage, admin, historia clinica) both need to grow: a real nav driven by the live group read, and a redirector branch per section in priority order. Includes sign-out, which does not exist anywhere in the app.