fix(audit): critical C3 — enforce residential module gate on all v1 API routes

Adds assertResidentialModuleEnabled(ctx.portId) as the first statement in
every residential v1 handler (24 handlers across 13 files), mirroring the
Tenancies pattern. Previously the disabled-module state was enforced only
in the page layout, so a disabled module still accepted API writes
(including partner-forward emails on residential interest creation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/v1/residential/assignable-users/route.ts

@@ -5,6 +5,7 @@ import { withAuth, withPermission } from '@/lib/api/helpers';
 import { db } from '@/lib/db';
 import { roles, user, userPortRoles } from '@/lib/db/schema/users';
 import { errorResponse } from '@/lib/errors';
+import { assertResidentialModuleEnabled } from '@/lib/services/residential-module.service';
 
 /**
  * Returns the set of users in the current port who can be assigned a
@@ -21,6 +22,7 @@ import { errorResponse } from '@/lib/errors';
 export const GET = withAuth(
   withPermission('residential_interests', 'view', async (_req, ctx) => {
     try {
+      await assertResidentialModuleEnabled(ctx.portId);
       const rows = await db
         .selectDistinct({
           id: user.id,