feat: implement role-based login validation to restrict user/agent portal access

src/auth/auth.service.ts

@@ -168,6 +168,20 @@ export class AuthService {
       throw new UnauthorizedException('Invalid email or password');
     }
 
+    // Role-based login validation (only when loginRole is provided from web/mobile tabs)
+    if (dto.loginRole) {
+      if (dto.loginRole === 'USER' && user.role === UserRole.AGENT) {
+        throw new UnauthorizedException(
+          'This email is registered as an Agent. Please use the Agent tab to sign in.',
+        );
+      }
+      if (dto.loginRole === 'AGENT' && user.role === UserRole.USER) {
+        throw new UnauthorizedException(
+          'This email is registered as a User. Please use the User tab to sign in.',
+        );
+      }
+    }
+
     // Check if 2FA is enabled
     if (user.twoFactorEnabled) {
       // Generate temporary token for 2FA verification