fix(folders): logging, files-rescue, hard-delete wiring, audit logs

- A6: logger import + warn calls in document-folders.service.ts
- G-C1: re-parent files (not just documents) in deleteFolderSoftRescue
- A4: importer sets files.folder_id (was only setting documents.folder_id)
- A7 + G-C3: demote system folder + nullify scratchpadNotes in client-hard-delete
- Defense-in-depth portId on folder-move UPDATE
- Audit logs for createFolder, syncEntityFolderName, archive/restore suffix
- portId in companies/yachts archive log context
- Row-count telemetry in backfill CLI

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/clients.service.ts

@@ -561,8 +561,11 @@ export async function archiveClient(id: string, portId: string, meta: AuditMeta)
   // being stamped before the HTTP response returns. Task 5 (rename
   // hook) uses await because the rename should be visible to the
   // next read; archive does not.
-  void applyEntityArchivedSuffix(portId, 'client', id).catch((err) => {
-    logger.warn({ err, clientId: id }, 'Failed to apply archived suffix to client folder');
+  void applyEntityArchivedSuffix(portId, 'client', id, meta.userId).catch((err) => {
+    logger.warn(
+      { err, clientId: id, portId },
+      'Failed to apply archived suffix to client folder',
+    );
   });
 
   void createAuditLog({
@@ -593,8 +596,11 @@ export async function restoreClient(id: string, portId: string, meta: AuditMeta)
 
   await restore(clients, clients.id, id);
 
-  void applyEntityRestoredSuffix(portId, 'client', id).catch((err) => {
-    logger.warn({ err, clientId: id }, 'Failed to clear archived suffix on client folder');
+  void applyEntityRestoredSuffix(portId, 'client', id, meta.userId).catch((err) => {
+    logger.warn(
+      { err, clientId: id, portId },
+      'Failed to clear archived suffix on client folder',
+    );
   });
 
   void createAuditLog({