2e0d63f7f6
email null-dereference guard, externalize DEMO_STAFF_ID 1. portal.ts:138 — add null guard for portalSession before accessing .id (TS18048: 'portalSession' is possibly 'undefined') 2. rbac.ts:130 — guard jwt.email before split() to prevent runtime throw 3. portal.ts:39,105 — externalize DEMO_STAFF_ID as env var (process.env.DEMO_STAFF_ID ?? "00000000-...") Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>