feat(documents): ensureSystemRoots + wire into createPort

Adds idempotent root-folder bootstrap (Clients/Companies/Yachts)
called on every port-init. ON CONFLICT DO NOTHING on the sibling-name
unique index prevents racing inserts; the re-SELECT returns the stable
row set in SYSTEM_ROOT_NAMES order. Same helper is invoked by the
backfill script in a later task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/unit/document-folders-system-folders.test.ts

@@ -0,0 +1,63 @@
+/**
+ * Task 2 — ensureSystemRoots (TDD).
+ *
+ * Fixture convention: makePort from helpers/factories (async DB insert);
+ * TEST_USER_ID resolved once via beforeAll from a seeded user — same pattern
+ * as document-folders-crud.test.ts and alerts-tenant-isolation.test.ts.
+ */
+
+import { describe, it, expect, beforeAll, beforeEach } from 'vitest';
+import { and, eq } from 'drizzle-orm';
+
+import { db } from '@/lib/db';
+import { documentFolders } from '@/lib/db/schema/documents';
+import { user } from '@/lib/db/schema/users';
+import { ensureSystemRoots } from '@/lib/services/document-folders.service';
+import { makePort } from '../helpers/factories';
+
+let TEST_USER_ID = '';
+
+beforeAll(async () => {
+  const [u] = await db.select({ id: user.id }).from(user).limit(1);
+  if (!u) throw new Error('No user available; run pnpm db:seed first');
+  TEST_USER_ID = u.id;
+});
+
+describe('document-folders service · ensureSystemRoots', () => {
+  let portId: string;
+
+  beforeEach(async () => {
+    const port = await makePort();
+    portId = port.id;
+    await db.delete(documentFolders).where(eq(documentFolders.portId, portId));
+  });
+
+  it('creates Clients, Companies, and Yachts root folders with system_managed=true', async () => {
+    await ensureSystemRoots(portId, TEST_USER_ID);
+    const rows = await db
+      .select()
+      .from(documentFolders)
+      .where(and(eq(documentFolders.portId, portId), eq(documentFolders.entityType, 'root')));
+    expect(rows.map((r) => r.name).sort()).toEqual(['Clients', 'Companies', 'Yachts']);
+    for (const r of rows) {
+      expect(r.systemManaged).toBe(true);
+      expect(r.parentId).toBeNull();
+      expect(r.entityId).toBeNull();
+    }
+  });
+
+  it('is idempotent — second call does not create duplicates', async () => {
+    await ensureSystemRoots(portId, TEST_USER_ID);
+    await ensureSystemRoots(portId, TEST_USER_ID);
+    const rows = await db
+      .select()
+      .from(documentFolders)
+      .where(and(eq(documentFolders.portId, portId), eq(documentFolders.entityType, 'root')));
+    expect(rows).toHaveLength(3);
+  });
+
+  it('returns the three root rows in a stable order (Clients, Companies, Yachts)', async () => {
+    const roots = await ensureSystemRoots(portId, TEST_USER_ID);
+    expect(roots.map((r) => r.name)).toEqual(['Clients', 'Companies', 'Yachts']);
+  });
+});