feat(rx): multi-tenant por clinica_id + página /clients de clientes ativos

- clinica_id (tenant do scoreodonto, clinicas.id) como eixo de isolamento em
  clinics_devices e images (+índices); clinic_name vira rótulo legível.
- Cadastro de device, socket (machine_token) e uploads (direct + legado) gravam clinica_id.
- Listagens (/images, /patients, /by-patient, /unique-clinics) filtram por clinica_id.
- /clients: lista clientes Windows ativos (inclui autenticados sem client-identify),
  tempo real + polling, exibe a clínica.
- send-image marcado como legado (client real usa Direct Upload).

Inclui trabalho de dev acumulado no working tree (não havia commits desde origin/main).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -2,13 +2,15 @@ version: '3.8'
 
 services:
   app:
-    build: 
+    build:
       context: ./dental-server
       dockerfile: Dockerfile
     container_name: rx_scoreodonto_app
     restart: unless-stopped
     ports:
       - "8083:3000"
+    env_file:
+      - .secrets
     environment:
       - NODE_ENV=production
       - PORT=3000
@@ -16,14 +18,11 @@ services:
       - DB_HOST=10.99.0.3
       - DB_PORT=5432
       - DB_USER=clube67
-      - DB_PASSWORD=clube67_db_pass_9903
       - DB_NAME=dental_images
       - REDIS_HOST=10.99.0.3
       - REDIS_PORT=6379
-      - REDIS_PASSWORD=clube67_db_pass_9903
       - UPLOAD_DIR=/app/uploads
       - PROCESSED_DIR=/app/processed
-      - JWT_SECRET=9f8e7d6c5b4a39281802384f5e6d7c8b9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5
       - ALLOWED_ORIGINS=https://rx.scoreodonto.com
     volumes:
       - ./uploads:/app/uploads