Harden Next.js operator UI for multi-tenant SaaS workflows

[fractional-pm]

Motivation

• Harden the operator UI for enterprise multi-tenant usage by scoping requests to a tenant and reducing risky inputs.
• Prevent accidental secret exposure or injection via the UI by restricting overrides for sensitive environment keys.
• Reduce path traversal and malformed branch/file inputs that could lead to unsafe repo operations.

Description

• Added a required Tenant ID input and validation, and prefixed outbound instruction with [tenant:<id>] to scope requests.
• Introduced client-side validators assertSafeBranch and assertSafeFiles and applied them before building the assist request to block path traversal and unsupported branch names.
• Hardened environment parsing in parseEnvVars by denying a FORBIDDEN_ENV_KEYS list (e.g. OPENAI_API_KEY, GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, DATABASE_URL).
• Updated hero copy to reflect an enterprise-grade, multi-tenant operator console and kept existing guardrails requiring explicit authorization for commits/pushes/PRs.

Testing

• Ran the web build with cd web && npm run build, which completed successfully (including Next.js compilation, linting, and page generation).

---

Codex Task