feat(portal): replace magic-link with email/password + admin-initiated activation

The client portal no longer uses passwordless / magic-link sign-in. Each
client now has a `portal_users` row with a scrypt-hashed password,
created by an admin from the client detail page; the admin's invite
mails an activation link that the client uses to set their own password.
Forgot-password is wired through the same token mechanism.

Schema (migration `0009_outgoing_rumiko_fujikawa.sql`):

- `portal_users` — one per client account, separate from the CRM
  `users` table (better-auth) so the auth realms stay isolated. Email
  is globally unique, password is null until activation.
- `portal_auth_tokens` — single-use activation / reset tokens. Stores
  only the SHA-256 hash so a DB compromise never leaks live tokens.

Services:

- `src/lib/portal/passwords.ts` — scrypt hash/verify (no new deps;
  uses node:crypto), token mint+hash helpers.
- `src/lib/services/portal-auth.service.ts` — createPortalUser,
  resendActivation, activateAccount, signIn (timing-safe),
  requestPasswordReset, resetPassword. Auth failures throw the new
  UnauthorizedError (401); enumeration-safe behaviour everywhere.

Routes:

- POST /api/portal/auth/sign-in — sets the existing portal JWT cookie.
- POST /api/portal/auth/forgot-password — always 200.
- POST /api/portal/auth/reset-password — token + new password.
- POST /api/portal/auth/activate — token + initial password.
- POST /api/v1/clients/:id/portal-user — admin invite (and `?action=resend`).
- Removed: /api/portal/auth/request, /api/portal/auth/verify (magic link).

UI:

- /portal/login — replaced email-only magic-link form with email +
  password + "forgot password" link.
- /portal/forgot-password, /portal/reset-password, /portal/activate — new.
- New shared `PasswordSetForm` component used by activate + reset.
- New `PortalInviteButton` rendered on the client detail header.

Email send:

- `createTransporter` now wires SMTP auth when SMTP_USER+SMTP_PASS are
  set (gmail app-password or marina-server creds, configured via env).
- `SMTP_FROM` env var lets the sender address be overridden without
  pinning it to `noreply@${SMTP_HOST}`.

Tests:

- Smoke spec 17 (client-portal) updated to the new flow: 7/7 green.
- Smoke specs 02-crud-spine, 05-invoices, 20-critical-path updated to
  match the post-refactor client + invoice forms (drop companyName,
  use OwnerPicker + billingEmail).
- Vitest 652/652 still green; type-check clean.

Drops the dead `requestMagicLink` from portal.service.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/e2e/smoke/helpers.ts

@@ -21,10 +21,7 @@ export const USERS = {
  * Log in as a specific user via the UI login page.
  * Waits for the dashboard to load after successful login.
  */
-export async function login(
-  page: Page,
-  role: keyof typeof USERS = 'super_admin',
-) {
+export async function login(page: Page, role: keyof typeof USERS = 'super_admin') {
   const user = USERS[role];
 
   await page.goto('/login');
@@ -90,3 +87,40 @@ export async function waitForSheet(page: Page) {
     timeout: 5_000,
   });
 }
+
+/**
+ * Resolve the port-nimara port ID via API.
+ *
+ * Used by tests that drive the JSON API directly with `page.request.*`.
+ * The server-side `withAuth` helper resolves port context from the
+ * `X-Port-Id` header (or the user's default-port preference), so any
+ * direct API call outside a port-scoped URL has to set the header. This
+ * caches the lookup per page so the lookup happens once.
+ */
+const portIdCache = new WeakMap<Page, string>();
+export async function getPortId(page: Page): Promise<string> {
+  const cached = portIdCache.get(page);
+  if (cached) return cached;
+  const res = await page.request.get('/api/v1/admin/ports');
+  if (!res.ok()) {
+    throw new Error(`Failed to resolve port id: ${res.status()} ${await res.text()}`);
+  }
+  const body = (await res.json()) as { data?: Array<{ id: string; slug: string }> };
+  const port = body.data?.find((p) => p.slug === PORT_SLUG);
+  if (!port) {
+    throw new Error(`Port ${PORT_SLUG} not in admin ports response`);
+  }
+  portIdCache.set(page, port.id);
+  return port.id;
+}
+
+/**
+ * Build headers for direct JSON-API calls inside tests, including the
+ * `X-Port-Id` that the auth helper requires.
+ */
+export async function apiHeaders(page: Page): Promise<Record<string, string>> {
+  return {
+    'Content-Type': 'application/json',
+    'X-Port-Id': await getPortId(page),
+  };
+}