feat(documents): ensureSystemRoots + wire into createPort

Adds idempotent root-folder bootstrap (Clients/Companies/Yachts)
called on every port-init. ON CONFLICT DO NOTHING on the sibling-name
unique index prevents racing inserts; the re-SELECT returns the stable
row set in SYSTEM_ROOT_NAMES order. Same helper is invoked by the
backfill script in a later task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/ports.service.ts

@@ -7,6 +7,7 @@ import { createAuditLog, type AuditMeta } from '@/lib/audit';
 import { ConflictError, NotFoundError } from '@/lib/errors';
 import { emitToRoom } from '@/lib/socket/server';
 import type { CreatePortInput, UpdatePortInput } from '@/lib/validators/ports';
+import { ensureSystemRoots } from '@/lib/services/document-folders.service';
 
 export async function listPorts() {
   return db.select().from(ports).orderBy(ports.name);
@@ -40,6 +41,8 @@ export async function createPort(data: CreatePortInput, meta: AuditMeta) {
     })
     .returning();
 
+  await ensureSystemRoots(port!.id, meta.userId);
+
   void createAuditLog({
     userId: meta.userId,
     portId: meta.portId,