fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

Closes the second wave of HIGH-priority audit findings:

* fetchWithTimeout helper (new src/lib/fetch-with-timeout.ts) wraps
  Documenso, OCR, currency, Umami, IMAP, etc. — a hung upstream can
  no longer pin a worker concurrency slot indefinitely.  OpenAI client
  passes timeout: 30_000.  ImapFlow gets socket / greeting / connection
  timeouts.
* SIGTERM / SIGINT handler in src/server.ts drains in-flight HTTP,
  closes Socket.io, and disconnects Redis before exit; compose
  stop_grace_period bumped to 30s.  Adds closeSocketServer() helper.
* env.ts gains zod-validated PORT and MULTI_NODE_DEPLOYMENT, and
  filesystem.ts now reads from env (a typo can no longer silently
  disable the multi-node guard).
* Per-port Documenso template + recipient IDs land in system_settings
  with env fallback (PortDocumensoConfig now exposes eoiTemplateId,
  clientRecipientId, developerRecipientId, approvalRecipientId).
  document-templates.ts uses the per-port config and threads portId
  into documensoGenerateFromTemplate().
* Migration 0042 wires the eleven HIGH-tier missing FK constraints
  (documents/files/interests/reminders/berth_waiting_list/
  form_submissions) plus polymorphic CHECK round 2
  (yacht_ownership_history.owner_type, document_sends.document_kind),
  invoices.billing_entity_id NOT EMPTY, and clients.merged_into self-FK.
  Drizzle schema columns updated to .references(...) where possible
  so the misleading "FK wired in relations.ts" comments are gone.

Test status: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §§5,6,7,8,9,10 +
MED §§14,15,16,18.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/db/migrations/0042_missing_fk_constraints.sql

@@ -0,0 +1,124 @@
+-- Audit-final v3 — wire the FK columns currently exposed via Drizzle
+-- relations() but missing actual Postgres constraints. relations() only
+-- configures relational query JOINs; it does NOT install constraints, so
+-- a service that writes interest_id='nonexistent' faces no DB rejection
+-- and downstream null-tolerant joins silently misbehave.
+--
+-- All adds are NOT VALID-friendly (we use IF NOT EXISTS via DO blocks);
+-- the migration is idempotent so re-running it is safe.
+--
+-- Cascade rule:
+--   nullable column → ON DELETE SET NULL    (orphan tolerance)
+--   notNull column  → ON DELETE RESTRICT    (force callers to clean up)
+-- All audit-listed columns happen to be nullable so they get SET NULL.
+--
+-- Refs: docs/audit-comprehensive-2026-05-05.md HIGH §10 (auditor-C3 Issue 1).
+
+-- documents
+DO $$ BEGIN
+  ALTER TABLE documents
+    ADD CONSTRAINT documents_interest_id_fkey
+      FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE documents
+    ADD CONSTRAINT documents_yacht_id_fkey
+      FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE documents
+    ADD CONSTRAINT documents_company_id_fkey
+      FOREIGN KEY (company_id) REFERENCES companies(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE documents
+    ADD CONSTRAINT documents_reservation_id_fkey
+      FOREIGN KEY (reservation_id) REFERENCES berth_reservations(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- files
+DO $$ BEGIN
+  ALTER TABLE files
+    ADD CONSTRAINT files_yacht_id_fkey
+      FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE files
+    ADD CONSTRAINT files_company_id_fkey
+      FOREIGN KEY (company_id) REFERENCES companies(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- interests (yacht_id is wired via relations only)
+DO $$ BEGIN
+  ALTER TABLE interests
+    ADD CONSTRAINT interests_yacht_id_fkey
+      FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- reminders
+DO $$ BEGIN
+  ALTER TABLE reminders
+    ADD CONSTRAINT reminders_interest_id_fkey
+      FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE reminders
+    ADD CONSTRAINT reminders_berth_id_fkey
+      FOREIGN KEY (berth_id) REFERENCES berths(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- berth_waiting_list
+DO $$ BEGIN
+  ALTER TABLE berth_waiting_list
+    ADD CONSTRAINT berth_waiting_list_yacht_id_fkey
+      FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- form_submissions
+DO $$ BEGIN
+  ALTER TABLE form_submissions
+    ADD CONSTRAINT form_submissions_interest_id_fkey
+      FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- ─── Polymorphic CHECK round 2 ──────────────────────────────────────────────
+-- 0036 covered yachts.current_owner_type and invoices.billing_entity_type.
+-- These two discriminators were missed and remain free-text.
+
+DO $$ BEGIN
+  ALTER TABLE yacht_ownership_history
+    ADD CONSTRAINT yacht_ownership_history_owner_type_chk
+      CHECK (owner_type IN ('client', 'company'));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+DO $$ BEGIN
+  ALTER TABLE document_sends
+    ADD CONSTRAINT document_sends_document_kind_chk
+      CHECK (document_kind IN ('berth_pdf', 'brochure'));
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- ─── invoices.billing_entity_id sanity check ───────────────────────────────
+-- The schema declared notNull() with default('') which combined with the
+-- 0036 type CHECK lets a row insert with billing_entity_type='client' and
+-- billing_entity_id='' — the polymorphic resolver looks up the empty
+-- string and returns null with no DB-level signal.
+
+DO $$ BEGIN
+  ALTER TABLE invoices
+    ADD CONSTRAINT invoices_billing_entity_id_nonempty_chk
+      CHECK (billing_entity_id <> '');
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;
+
+-- ─── clients.merged_into_client_id self-FK ─────────────────────────────────
+-- Already nullable; populated when a client is soft-merged into another.
+
+DO $$ BEGIN
+  ALTER TABLE clients
+    ADD CONSTRAINT clients_merged_into_client_id_fkey
+      FOREIGN KEY (merged_into_client_id) REFERENCES clients(id) ON DELETE SET NULL;
+EXCEPTION WHEN duplicate_object THEN NULL; END $$;

src/lib/db/migrations/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1778400000000,
       "tag": "0041_role_permissions_edit_keys",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "7",
+      "when": 1778500000000,
+      "tag": "0042_missing_fk_constraints",
+      "breakpoints": true
     }
   ]
 }