fix(documents): syncEntityFolderName defense-in-depth + log level

Two follow-ups from code review:
1. The UPDATE in the retry loop now scopes by both id and port_id so
   it matches every other mutation in document-folders.service.ts and
   honours the CLAUDE.md defense-in-depth pattern.
2. The three entity-rename hooks now log at warn level (not error) —
   a missed folder rename is best-effort cosmetic drift, not a paging
   incident. Matches the existing convention used elsewhere in the
   codebase for non-fatal background work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/document-folders.service.ts

@@ -561,7 +561,7 @@ export async function syncEntityFolderName(
       const [updated] = await db
         .update(documentFolders)
         .set({ name: candidate, updatedAt: new Date() })
-        .where(eq(documentFolders.id, folder.id))
+        .where(and(eq(documentFolders.id, folder.id), eq(documentFolders.portId, portId)))
         .returning();
       if (updated) return;
     } catch (err) {