chore: bulk commit of pre-existing changes

Includes:
- Admin dashboard layout and page updates
- API account auth module (routes, schemas, service)
- Dashboard sign-up form extraction, middleware refactor
- Marketplace proxy and middleware updates
- CORS origins expansion for dev environment
- Seed email domain correction (.com → .ma)
- Docs: create-account guide, fleet page, signup plan
- Various UI component and layout refinements

apps/dashboard/src/components/layout/DashboardAccessGuard.tsx

@@ -3,7 +3,7 @@
 import { usePathname, useRouter } from 'next/navigation'
 import { useEffect, useState } from 'react'
 import { apiFetch } from '@/lib/api'
-import { toDashboardAppPath, toPublicDashboardPath } from '@/lib/dashboardPaths'
+import { toDashboardAppPath } from '@/lib/dashboardPaths'
 
 type GeneratedMenuItem = {
   id: string
@@ -16,27 +16,35 @@ type EmployeeMenuResponse = {
   items: GeneratedMenuItem[]
 }
 
-function flattenInternalRoutes(items: GeneratedMenuItem[]): string[] {
+export function flattenInternalRoutes(items: GeneratedMenuItem[]): string[] {
   const routes: string[] = []
 
   const walk = (entry: GeneratedMenuItem) => {
     if (entry.itemType === 'INTERNAL_PAGE' && entry.routeOrUrl) {
-      routes.push(entry.routeOrUrl)
+      routes.push(toDashboardAppPath(entry.routeOrUrl))
     }
     entry.children.forEach(walk)
   }
 
   items.forEach(walk)
-  return routes
+  return Array.from(new Set(routes))
 }
 
-function isAllowedRoute(currentPath: string, allowedRoutes: string[]) {
+export function isAllowedRoute(currentPath: string, allowedRoutes: string[]) {
   return allowedRoutes.some((route) => {
     if (route === '/') return currentPath === '/'
     return currentPath === route || currentPath.startsWith(`${route}/`)
   })
 }
 
+export function resolveAccessRedirect(currentPath: string, allowedRoutes: string[]) {
+  if (allowedRoutes.length === 0) return null
+  if (isAllowedRoute(currentPath, allowedRoutes)) return null
+
+  const fallbackRoute = allowedRoutes[0] ?? '/'
+  return fallbackRoute === currentPath ? null : fallbackRoute
+}
+
 export default function DashboardAccessGuard({ children }: { children: React.ReactNode }) {
   const pathname = usePathname()
   const router = useRouter()
@@ -53,10 +61,10 @@ export default function DashboardAccessGuard({ children }: { children: React.Rea
         if (cancelled) return
 
         const allowedRoutes = flattenInternalRoutes(menu.items)
-        const fallbackRoute = allowedRoutes[0] ?? '/'
+        const redirectPath = resolveAccessRedirect(currentPath, allowedRoutes)
 
-        if (!isAllowedRoute(currentPath, allowedRoutes)) {
-          router.replace(toPublicDashboardPath(fallbackRoute))
+        if (redirectPath) {
+          router.replace(redirectPath)
           return
         }
 
@@ -65,7 +73,7 @@ export default function DashboardAccessGuard({ children }: { children: React.Rea
         if (cancelled) return
 
         if (error?.statusCode === 401 || error?.statusCode === 403 || error?.statusCode === 402) {
-          router.replace(toPublicDashboardPath('/'))
+          router.replace('/')
           return
         }