feat(portal): one Space, many portals — one CORS entry per cluster forever

fix(portal): act-as user, and a real error when a model is unreadable

docs: single state-of-play snapshot + HF_TOKEN in the test-secrets script

feat(mcp): build_portal tool — portals inside the automated pipeline

feat(portal): one-command portal build from a deployed liveboard

feat(portal): bring portal builder into the codebase