chore: bulk commit of pre-existing changes

Includes:
- Admin dashboard layout and page updates
- API account auth module (routes, schemas, service)
- Dashboard sign-up form extraction, middleware refactor
- Marketplace proxy and middleware updates
- CORS origins expansion for dev environment
- Seed email domain correction (.com → .ma)
- Docs: create-account guide, fleet page, signup plan
- Various UI component and layout refinements

apps/dashboard/next.config.js

@@ -27,11 +27,21 @@ const storagePatterns = [
 
 const DASHBOARD_BASE_PATH = '/dashboard'
 
-// In Docker dev the dashboard app runs on port 3001 while the marketplace proxy
-// is served from port 3000. When DASHBOARD_ASSET_PREFIX is set, Next should emit
-// absolute chunk URLs so /dashboard pages load their own JS/CSS from port 3001.
-const assetPrefix = normalizeAssetPrefix(process.env.DASHBOARD_ASSET_PREFIX, DASHBOARD_BASE_PATH)
-const securityHeaders = buildSecurityHeaders({ assetSources: [assetPrefix] })
+// basePath is required so the client-side router knows it's mounted at /dashboard.
+// Without it, React cannot hydrate because the URL (/dashboard/sign-up) doesn't
+// match the route (/sign-up). The Turbopack double-basePath prefetch bug is
+// handled by the marketplace middleware (307 redirect /dashboard/dashboard → /dashboard).
+//
+// In local development the dashboard is often viewed through the marketplace
+// proxy on port 3000 while the dashboard dev server runs on port 3001. Next
+// rewrites do not reliably proxy HMR WebSocket upgrades, so emit absolute
+// dashboard asset/HMR URLs directly to the dashboard dev server.
+const dashboardAssetPrefix = process.env.DASHBOARD_ASSET_PREFIX
+  ?? (process.env.NODE_ENV !== 'production' ? 'http://localhost:3001' : undefined)
+const assetPrefix = normalizeAssetPrefix(dashboardAssetPrefix, DASHBOARD_BASE_PATH)
+const securityHeaders = buildSecurityHeaders({
+  assetSources: [assetPrefix].filter(Boolean),
+})
 
 const nextConfig = {
   basePath: DASHBOARD_BASE_PATH,
@@ -48,12 +58,41 @@ const nextConfig = {
   transpilePackages: ['@rentaldrivego/types'],
   async headers() {
     return [
+      {
+        source: '/_next/static/media/:path*',
+        headers: [
+          {
+            key: 'Access-Control-Allow-Origin',
+            value: '*',
+          },
+        ],
+      },
       {
         source: '/:path*',
         headers: securityHeaders,
       },
     ]
   },
+  async redirects() {
+    return [
+      {
+        source: `${DASHBOARD_BASE_PATH}/:path*`,
+        destination: '/:path*',
+        permanent: false,
+      },
+      {
+        source: DASHBOARD_BASE_PATH,
+        destination: '/',
+        permanent: false,
+      },
+      {
+        source: '/',
+        destination: DASHBOARD_BASE_PATH,
+        permanent: false,
+        basePath: false,
+      },
+    ]
+  },
   async rewrites() {
     const apiOrigin = (process.env.API_INTERNAL_URL ?? process.env.API_URL ?? 'http://localhost:4000').replace(/\/api\/v1\/?$/, '')
     return [