fix(audit): critical C3 — enforce residential module gate on all v1 API routes

Adds assertResidentialModuleEnabled(ctx.portId) as the first statement in
every residential v1 handler (24 handlers across 13 files), mirroring the
Tenancies pattern. Previously the disabled-module state was enforced only
in the page layout, so a disabled module still accepted API writes
(including partner-forward emails on residential interest creation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app/api/v1/residential/clients/[id]/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { withAuth, withPermission } from '@/lib/api/helpers';
 import { parseBody } from '@/lib/api/route-helpers';
 import { errorResponse } from '@/lib/errors';
+import { assertResidentialModuleEnabled } from '@/lib/services/residential-module.service';
 import {
   archiveResidentialClient,
   getResidentialClientById,
@@ -13,6 +14,7 @@ import { updateResidentialClientSchema } from '@/lib/validators/residential';
 export const GET = withAuth(
   withPermission('residential_clients', 'view', async (req, ctx, params) => {
     try {
+      await assertResidentialModuleEnabled(ctx.portId);
       const client = await getResidentialClientById(params.id!, ctx.portId);
       return NextResponse.json({ data: client });
     } catch (error) {
@@ -24,6 +26,7 @@ export const GET = withAuth(
 export const PATCH = withAuth(
   withPermission('residential_clients', 'edit', async (req, ctx, params) => {
     try {
+      await assertResidentialModuleEnabled(ctx.portId);
       const body = await parseBody(req, updateResidentialClientSchema);
       const updated = await updateResidentialClient(params.id!, ctx.portId, body, {
         userId: ctx.userId,
@@ -41,6 +44,7 @@ export const PATCH = withAuth(
 export const DELETE = withAuth(
   withPermission('residential_clients', 'delete', async (req, ctx, params) => {
     try {
+      await assertResidentialModuleEnabled(ctx.portId);
       await archiveResidentialClient(params.id!, ctx.portId, {
         userId: ctx.userId,
         portId: ctx.portId,