feat(client-groups): CM-1 data layer — groups entity, membership, service, Mailchimp scaffold

- client_groups + client_group_members tables (migration 0094, port_id cascade)
- client_groups permission resource (view/manage) in catalog + role backfill
- service: CRUD + wipe-and-rewrite membership + member email resolution
- mailchimp.service scaffold: config reader + inert one-way sync (mapping
  deferred until the client's MC account is wired, per CM-1 decision)
- 4 integration tests (CRUD, membership, email resolution, port-scope guard)

Backend only — API routes + UI to follow. tsc clean, 1635 vitest pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/helpers/factories.ts

@@ -385,6 +385,7 @@ export function makeFullPermissions(): RolePermissions {
       change_stage: true,
     },
     inquiries: { view: true, manage: true },
+    client_groups: { view: true, manage: true },
   };
 }
 
@@ -474,6 +475,7 @@ export function makeViewerPermissions(): RolePermissions {
       change_stage: false,
     },
     inquiries: { view: true, manage: false },
+    client_groups: { view: true, manage: false },
   };
 }
 
@@ -563,6 +565,7 @@ export function makeSalesAgentPermissions(): RolePermissions {
       change_stage: false,
     },
     inquiries: { view: true, manage: true },
+    client_groups: { view: true, manage: true },
   };
 }
 
@@ -652,6 +655,7 @@ export function makeSalesManagerPermissions(): RolePermissions {
       change_stage: true,
     },
     inquiries: { view: true, manage: true },
+    client_groups: { view: true, manage: true },
   };
 }