Secure proposal workspace

Start with a protected RFP command center.

Use GenMB authentication for Google, magic link, and verified email/password access. Dashboard routes stay protected.