Separate entry point for the internal college workspace

Public site pages stay in the root URL-space. Internal work now enters through /portal and keeps its own layout, navigation, and guarded route tree.