refactor(services): centralize AuditMeta + transactional setEntityTags helper

The same `interface AuditMeta { userId; portId; ipAddress; userAgent }`
was duplicated in 26 service files. Move the canonical definition into
`@/lib/audit` next to the related types and update every service to
import it. `ServiceAuditMeta` (the alias used in invoices.ts and
expenses.ts) collapses into the same name.

Tag CRUD across clients/companies/yachts/interests/berths followed an
identical wipe-then-rewrite recipe with two latent issues: the delete
and insert weren't wrapped in a transaction (a partial failure left
the entity with zero tags) and the audit-log payload shape diverged
(`newValue: { tagIds }` for clients/yachts/companies but
`metadata: { type: 'tags_updated', tagIds }` for interests/berths).

Extract `setEntityTags` in `entity-tags.helper.ts` that performs the
delete+insert inside a single transaction, normalizes the audit payload
to `newValue: { tagIds }`, and dispatches the per-entity socket event
through a switch so `ServerToClientEvents` typing stays intact.

The five `setXTags(...)` service functions now do parent-row tenant
verification and delegate the join-table work + side effects.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/berths.service.ts

@@ -3,11 +3,12 @@ import { and, eq, gte, lte, inArray } from 'drizzle-orm';
 import { db } from '@/lib/db';
 import { berths, berthTags, berthWaitingList, berthMaintenanceLog } from '@/lib/db/schema/berths';
 import { tags } from '@/lib/db/schema/system';
-import { createAuditLog } from '@/lib/audit';
+import { createAuditLog, type AuditMeta } from '@/lib/audit';
 import { diffEntity } from '@/lib/entity-diff';
 import { NotFoundError } from '@/lib/errors';
 import { buildListQuery } from '@/lib/db/query-builder';
 import { emitToRoom } from '@/lib/socket/server';
+import { setEntityTags } from '@/lib/services/entity-tags.helper';
 import { ConflictError } from '@/lib/errors';
 import type {
   CreateBerthInput,
@@ -18,13 +19,6 @@ import type {
   UpdateWaitingListInput,
 } from '@/lib/validators/berths';
 
-interface AuditMeta {
-  userId: string;
-  portId: string;
-  ipAddress: string;
-  userAgent: string;
-}
-
 // ─── List ─────────────────────────────────────────────────────────────────────
 
 export async function listBerths(portId: string, query: ListBerthsQuery) {
@@ -300,30 +294,18 @@ export async function setBerthTags(id: string, portId: string, tagIds: string[],
   });
   if (!existing) throw new NotFoundError('Berth');
 
-  // Delete existing tags then insert new ones
-  await db.delete(berthTags).where(eq(berthTags.berthId, id));
-
-  if (tagIds.length > 0) {
-    await db.insert(berthTags).values(tagIds.map((tagId) => ({ berthId: id, tagId })));
-  }
-
-  void createAuditLog({
-    userId: meta.userId,
-    portId,
-    action: 'update',
-    entityType: 'berth',
+  const result = await setEntityTags({
+    joinTable: berthTags,
+    entityColumn: berthTags.berthId,
+    tagColumn: berthTags.tagId,
     entityId: id,
-    metadata: { type: 'tags_updated', tagIds },
-    ipAddress: meta.ipAddress,
-    userAgent: meta.userAgent,
+    portId,
+    tagIds,
+    meta,
+    entityType: 'berth',
   });
 
-  emitToRoom(`port:${portId}`, 'berth:updated', {
-    berthId: id,
-    changedFields: ['tags'],
-  });
-
-  return { berthId: id, tagIds };
+  return { berthId: result.entityId, tagIds: result.tagIds };
 }
 
 // ─── Add Maintenance Log ──────────────────────────────────────────────────────