feat(tenancies-p5): sidebar entry + 404 top-level page + API module gate

- Dashboard layout resolves tenanciesModuleByPort server-side (one
  isTenanciesModuleEnabled call per port the user has access to) and
  passes the map through AppShell → Sidebar. Atomic SSR — no
  flicker of the nav entry in/out after hydration.
- Sidebar gains NavItemGated.requiresTenanciesModule. The Tenancies
  entry (KeyRound icon, immediately below Berths) only renders when
  the currently-active port has the flag flipped on. Per-port live
  switch fires when the rep toggles ports without reload.
- /[portSlug]/tenancies + /[portSlug]/tenancies/[id] both call
  isTenanciesModuleEnabled and notFound() when disabled — guards
  against direct URL access even when the sidebar is hidden.
- API routes (/api/v1/tenancies, /[id], /berths/[id]/tenancies)
  prepended with assertTenanciesModuleEnabled — matches design §
  "All routes ... return 404 when off". NotFoundError maps to 404.
- Existing tenancy API tests get a makePortWithTenancies() helper
  (calls enableTenanciesModule after makePort) so the gate is
  satisfied. Affects 2 test files (16 tests retargeted).

Verified: tsc clean, 1493/1493 vitest.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/integration/api/berth-tenancies-list.test.ts

@@ -10,6 +10,7 @@ import { describe, it, expect } from 'vitest';
 
 import { listHandler } from '@/app/api/v1/tenancies/handlers';
 import { createHandler as createTenancyHandler } from '@/app/api/v1/berths/[id]/tenancies/handlers';
+import { enableTenanciesModule } from '@/lib/services/tenancies-module.service';
 import { makeMockCtx, makeMockRequest } from '../../helpers/route-tester';
 import {
   makeBerth,
@@ -19,6 +20,12 @@ import {
   makeYacht,
 } from '../../helpers/factories';
 
+async function makePortWithTenancies(): Promise<Awaited<ReturnType<typeof makePort>>> {
+  const port = await makePort();
+  await enableTenanciesModule(port.id);
+  return port;
+}
+
 async function seedTenancy(portId: string) {
   const berth = await makeBerth({ portId });
   const client = await makeClient({ portId });
@@ -40,7 +47,7 @@ async function seedTenancy(portId: string) {
 
 describe('GET /api/v1/tenancies', () => {
   it('returns all tenancies for the requesting port', async () => {
-    const port = await makePort();
+    const port = await makePortWithTenancies();
     const r1 = await seedTenancy(port.id);
     const r2 = await seedTenancy(port.id);
 
@@ -55,8 +62,8 @@ describe('GET /api/v1/tenancies', () => {
   });
 
   it('does not leak tenancies from a different port', async () => {
-    const portA = await makePort();
-    const portB = await makePort();
+    const portA = await makePortWithTenancies();
+    const portB = await makePortWithTenancies();
     const tenancyInB = await seedTenancy(portB.id);
 
     // Caller is operating in portA; portB's tenancy must not appear.
@@ -70,7 +77,7 @@ describe('GET /api/v1/tenancies', () => {
   });
 
   it('honors pagination via query params', async () => {
-    const port = await makePort();
+    const port = await makePortWithTenancies();
     await seedTenancy(port.id);
     await seedTenancy(port.id);
     await seedTenancy(port.id);