feat: implement complex selection flow

AGENTS.md

@@ -111,3 +111,41 @@ To enable login with Google:
 3. The backend configures `socialProviders.google` automatically.
 
 4. Frontend uses `authClient.signIn.social({ provider: 'google', callbackURL: 'http://localhost:5173' })`.
+
+## Complex Selection (Multi-tenancy)
+
+The app supports users with multiple complexes. Each user has a role per complex (`ADMIN` or `EMPLOYEE`), stored in `ComplexUser` table.
+
+### Flow
+
+1. **Login** (password or Google OAuth):
+   - After auth, call `GET /api/complexes/mine` to get user's complexes
+   - If 1 complex → auto-select via `POST /api/complexes/select` → redirect to `/`
+   - If >1 complexes → redirect to `/select-complex`
+
+2. **Select Complex Page** (`/select-complex`):
+   - List all complexes with roles
+   - User selects one → `POST /api/complexes/select` → set cookie → redirect to `/`
+
+3. **Home Page** (`/`):
+   - If no cookie (first visit) → auto-select if 1 complex, else redirect
+   - Use `GET /api/complexes/me` to get current selected complex
+
+### Cookie
+
+- Name: `selected-complex-id`
+- httpOnly, secure (prod), sameSite: strict
+- MaxAge: 30 days
+- Set by `POST /api/complexes/select`
+
+### Endpoints
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/api/complexes/mine` | List all complexes with role |
+| GET | `/api/complexes/me` | Get currently selected complex |
+| POST | `/api/complexes/select` | Select complex (sets cookie) |
+
+### Profile Role
+
+The profile page shows the user's role for the **selected complex**, not the global user role. This is fetched from `ComplexUser` table using the cookie value.