Build a Client Portal

Build a client portal.

Each client account can see only their own:
- Project status and milestones
- Files and documents
- Messages with our team
- Invoices and their payment status

Requirements:
- Clients are users with a client role; staff have a staff role and can see all clients.
- Row level security must isolate every table by client, and I want to be able to prove it.
- File storage must be private with access checked per request, not public URLs.
- Staff can post updates and upload files against a client.

Include a test plan I can run with two client accounts to confirm no data leaks.