fix(regressions): client-bundle ioredis + Drizzle ANY() array bindings

Two regressions from yesterday's audit-tier-0 work that broke the dev
server and every clients API call.

- baseListQuerySchema lived in route-helpers.ts, which was made
  server-only by the rate-limit import. Every validator imported it,
  pulling ioredis (and dns/net/tls/fs/node:async_hooks) into the client
  bundle — every form/detail page returned 500 in dev. Extracted the
  schema to src/lib/api/list-query.ts and updated all 14 validators.
- clients.service.listClients and email-compose used raw SQL
  ANY(\${jsArray}) which Drizzle binds as JSON — Postgres rejects with
  42809 "op ANY/ALL (array) requires array on right side". Switched to
  the inArray helper.

GET /api/v1/clients now returns 200 again. Affects every form/detail
page that imports a validator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/email-compose.service.ts

@@ -1,5 +1,5 @@
 import nodemailer from 'nodemailer';
-import { and, eq, sql } from 'drizzle-orm';
+import { and, eq, inArray, sql } from 'drizzle-orm';
 
 import { db } from '@/lib/db';
 import { emailAccounts, emailMessages, emailThreads } from '@/lib/db/schema/email';
@@ -295,7 +295,7 @@ async function sendSystem(
     const matchingDocs = await db
       .select({ id: documents.id, signedFileId: documents.signedFileId })
       .from(documents)
-      .where(and(eq(documents.portId, portId), sql`${documents.signedFileId} = ANY(${fileIds})`));
+      .where(and(eq(documents.portId, portId), inArray(documents.signedFileId, fileIds)));
 
     for (const doc of matchingDocs) {
       await db.insert(documentEvents).values({