fix: route guard and landing page links for institutional login portal

frontend/src/main.jsx

@@ -39,8 +39,8 @@ function ProtectedRoute({ children }) {
 }
 
 function InstitutionalProtectedRoute({ children }) {
-  const { isAuthenticated } = useAuthStore()
-  return isAuthenticated ? children : <Navigate to="/login/institutional" />
+  const { isAuthenticated, user } = useAuthStore()
+  return (isAuthenticated && user?.user_type === 'institutional') ? children : <Navigate to="/login/institutional" />
 }
 
 function App() {

frontend/src/pages/LandingPage.jsx

@@ -322,7 +322,7 @@ export default function LandingPage() {
               <li>Regulatory copilot — paste any CBK circular and get an impact analysis</li>
               <li>Role-based access: the UI changes completely by role (Auditor vs Risk Manager)</li>
             </ul>
-            <Link to="/institutional" className="tier-cta red">Request institutional access</Link>
+            <Link to="/login/institutional" className="tier-cta red">Access Institutional Portal</Link>
           </div>
         </div>
       </section>
@@ -382,7 +382,7 @@ export default function LandingPage() {
             <div className="cta-card-num re">03</div>
             <h3>Senti Institutional</h3>
             <p>For compliance teams, risk officers, and SACCOs that need a hardened control panel — not a consumer chat interface.</p>
-            <Link to="/institutional" className="cta-card-btn btn-re">Request access →</Link>
+            <Link to="/login/institutional" className="cta-card-btn btn-re">Access Portal →</Link>
           </div>
         </div>
       </section>