fix(folders): logging, files-rescue, hard-delete wiring, audit logs

- A6: logger import + warn calls in document-folders.service.ts
- G-C1: re-parent files (not just documents) in deleteFolderSoftRescue
- A4: importer sets files.folder_id (was only setting documents.folder_id)
- A7 + G-C3: demote system folder + nullify scratchpadNotes in client-hard-delete
- Defense-in-depth portId on folder-move UPDATE
- Audit logs for createFolder, syncEntityFolderName, archive/restore suffix
- portId in companies/yachts archive log context
- Row-count telemetry in backfill CLI

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/v1/documents/[id]/folder/route.ts

@@ -41,7 +41,7 @@ export const PATCH = withAuth(
       const [updated] = await db
         .update(documents)
         .set({ folderId: body.folderId, updatedAt: new Date() })
-        .where(eq(documents.id, docId))
+        .where(and(eq(documents.id, docId), eq(documents.portId, ctx.portId)))
         .returning();
 
       void createAuditLog({