feat(tenancies-p5): sidebar entry + 404 top-level page + API module gate

- Dashboard layout resolves tenanciesModuleByPort server-side (one
  isTenanciesModuleEnabled call per port the user has access to) and
  passes the map through AppShell → Sidebar. Atomic SSR — no
  flicker of the nav entry in/out after hydration.
- Sidebar gains NavItemGated.requiresTenanciesModule. The Tenancies
  entry (KeyRound icon, immediately below Berths) only renders when
  the currently-active port has the flag flipped on. Per-port live
  switch fires when the rep toggles ports without reload.
- /[portSlug]/tenancies + /[portSlug]/tenancies/[id] both call
  isTenanciesModuleEnabled and notFound() when disabled — guards
  against direct URL access even when the sidebar is hidden.
- API routes (/api/v1/tenancies, /[id], /berths/[id]/tenancies)
  prepended with assertTenanciesModuleEnabled — matches design §
  "All routes ... return 404 when off". NotFoundError maps to 404.
- Existing tenancy API tests get a makePortWithTenancies() helper
  (calls enableTenanciesModule after makePort) so the gate is
  satisfied. Affects 2 test files (16 tests retargeted).

Verified: tsc clean, 1493/1493 vitest.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/layout/app-shell.tsx

@@ -24,6 +24,9 @@ interface AppShellProps {
   /** Per-port logo URLs resolved server-side. Sidebar picks the entry
    *  matching the currently-active port from the UI store. */
   portLogoUrls: Record<string, string | null>;
+  /** Per-port `tenancies_module_enabled` resolution. Gates the Tenancies
+   *  sidebar entry SSR-side so the nav doesn't flicker in/out. */
+  tenanciesModuleByPort: Record<string, boolean>;
   /**
    * Server-rendered form-factor hint (from the request User-Agent). The
    * shell mounts the matching tree on first render so we never paint the
@@ -86,6 +89,7 @@ export function AppShell({
   user,
   ports,
   portLogoUrls,
+  tenanciesModuleByPort,
   initialFormFactor,
   children,
 }: AppShellProps) {
@@ -137,6 +141,7 @@ export function AppShell({
     user,
     ports,
     portLogoUrls,
+    tenanciesModuleByPort,
   };
 
   // Chrome subtree per tier.