feat: implement secure multi-tenancy, RBAC, and premium dark mode

- Enforced tenant isolation and Role-Based Access Control across all API routes

- Implemented secure profile avatar upload using multer and UUIDs

- Redesigned UI with a premium "Onyx & Gold" Charcoal dark mode

- Added Funnel Stage and Origin filters to Dashboard and User Detail pages

- Replaced "Referral" with "Indicação" across the platform and database

- Optimized Dockerfile and local environment setup for reliable deployments

- Fixed frontend syntax errors and improved KPI/Chart visualizations

App.tsx

@@ -11,10 +11,10 @@ import { Login } from './pages/Login';
 import { ForgotPassword } from './pages/ForgotPassword';
 import { ResetPassword } from './pages/ResetPassword';
 import { UserProfile } from './pages/UserProfile';
-import { getUserById } from './services/dataService';
+import { getUserById, logout } from './services/dataService';
 import { User } from './types';
 
-const AuthGuard: React.FC<{ children: React.ReactNode }> = ({ children }) => {
+const AuthGuard: React.FC<{ children: React.ReactNode, roles?: string[] }> = ({ children, roles }) => {
   const [user, setUser] = useState<User | null>(null);
   const [loading, setLoading] = useState(true);
   const location = useLocation();
@@ -22,7 +22,10 @@ const AuthGuard: React.FC<{ children: React.ReactNode }> = ({ children }) => {
   useEffect(() => {
     const checkAuth = async () => {
       const storedUserId = localStorage.getItem('ctms_user_id');
-      if (!storedUserId) {
+      const storedToken = localStorage.getItem('ctms_token');
+
+      if (!storedUserId || !storedToken || storedToken === 'undefined' || storedToken === 'null') {
+        if (storedToken) logout(); // Limpar se for "undefined" string
         setLoading(false);
         return;
       }
@@ -32,13 +35,13 @@ const AuthGuard: React.FC<{ children: React.ReactNode }> = ({ children }) => {
         if (fetchedUser && fetchedUser.status === 'active') {
           setUser(fetchedUser);
         } else {
-          localStorage.removeItem('ctms_user_id');
-          localStorage.removeItem('ctms_token');
-          localStorage.removeItem('ctms_tenant_id');
+          logout();
           setUser(null);
         }
       } catch (err) {
         console.error("Auth check failed", err);
+        logout();
+        setUser(null);
       } finally {
         setLoading(false);
       }
@@ -54,6 +57,10 @@ const AuthGuard: React.FC<{ children: React.ReactNode }> = ({ children }) => {
     return <Navigate to="/login" replace />;
   }
 
+  if (roles && !roles.includes(user.role)) {
+    return <Navigate to="/" replace />;
+  }
+
   return <Layout>{children}</Layout>;
 };
 
@@ -69,7 +76,7 @@ const App: React.FC = () => {
         <Route path="/admin/teams" element={<AuthGuard><Teams /></AuthGuard>} />
         <Route path="/users/:id" element={<AuthGuard><UserDetail /></AuthGuard>} />
         <Route path="/attendances/:id" element={<AuthGuard><AttendanceDetail /></AuthGuard>} />
-        <Route path="/super-admin" element={<AuthGuard><SuperAdmin /></AuthGuard>} />
+        <Route path="/super-admin" element={<AuthGuard roles={['super_admin']}><SuperAdmin /></AuthGuard>} />
         <Route path="/profile" element={<AuthGuard><UserProfile /></AuthGuard>} />
         <Route path="*" element={<Navigate to="/" replace />} />
       </Routes>