diff --git a/app/main.py b/app/main.py
new file mode 100644
index 0000000..d2f4e7d
--- /dev/null
+++ b/app/main.py
@@ -0,0 +1,21 @@
+"""
+Painel de Clientes — monta os routers de CLIENTE, CLIENTE_CONTATO e o
+gerador de chave manual. Ver docs/superpowers/specs/2026-08-13-painel-clientes-web-design.md.
+"""
+from fastapi import Depends, FastAPI
+from fastapi.responses import RedirectResponse
+from fastapi.staticfiles import StaticFiles
+
+from .auth import exigir_login
+from .routers import chave_manual, clientes, contatos
+
+app = FastAPI(title="Painel de Clientes")
+app.mount("/static", StaticFiles(directory="app/static"), name="static")
+app.include_router(clientes.router)
+app.include_router(contatos.router)
+app.include_router(chave_manual.router)
+
+
+@app.get("/")
+def raiz(usuario: str = Depends(exigir_login)):
+    return RedirectResponse(url="/clientes")
diff --git a/tests/test_main.py b/tests/test_main.py
new file mode 100644
index 0000000..d20ca84
--- /dev/null
+++ b/tests/test_main.py
@@ -0,0 +1,21 @@
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+client = TestClient(app)
+
+
+def test_raiz_sem_login_pede_credenciais():
+    resposta = client.get("/", follow_redirects=False)
+    assert resposta.status_code == 401
+
+
+def test_raiz_redireciona_para_clientes_com_login(monkeypatch):
+    from app.routers import clientes as router_clientes
+
+    monkeypatch.setattr(router_clientes.db_clientes, "listar_clientes", lambda busca=None, limite=100: [])
+    import base64
+    token = base64.b64encode(b"admin:teste123").decode()
+    resposta = client.get("/", headers={"Authorization": f"Basic {token}"}, follow_redirects=False)
+    assert resposta.status_code == 307
+    assert resposta.headers["location"] == "/clientes"