Portal routes are separated from the public homepage.

Authenticated work now lives under /portal and role-specific routes such as /portal/admin, /portal/producer, /portal/parent, and /portal/student. Public explainer content stays on the homepage.

• Unauthenticated deep links stay in the portal login flow.
• Successful sign-in returns users to an allowed portal destination.
• Wrong-role portal routes normalize to the signed-in user's own allowed route.