[yotamon]

What this fixes

• Keep Firebase account identity and agency role stable while navigating between agency and client workspaces.
• Explicitly separate agency working-client selection (for proposals, requests, pricing) from View as Client impersonation.
• Scope working-client and client-view session storage to the signed-in Firebase UID. Discard legacy global entries; clear account selections on sign-out.
• Reevaluate route authorization for each account, workspace and view mode, preventing stale role decisions while navigating.
• Add clear Agency/All clients selector and disambiguate organizations with the same visible name.
• Authenticate Prospects requests with the current Firebase bearer token and prioritize it over stale session cookies; scope React Query prospect data by user.

Regression tests added

• Workspace selection on agency and client accounts
• Account changes and old client-view storage
• Role/access recalculation during navigation
• Firebase bearer priority over stale server session cookies

Validation

• Requested focused affected-code CI.
• No preview deployment requested.
• Projects listing may still have an independent Firestore permissions/index issue; verify on live account after review.

Risk / rollout

Changes touch authentication and permissions. Please do not merge without passing CI and manual smoke test for agency proposals, requests, client-view exit, and projects/prospects.