fix(security): port-scope clientId/berthId/yachtId on interests + clientRelationships

Pass-6 findings — both MEDIUM cross-tenant FK injection.

- interests.service: createInterest/updateInterest/linkBerth accepted
  clientId/berthId/yachtId from the request body without verifying the
  referenced row belongs to the caller's port. getInterestById joins
  clients/berths/yachtTags on these FKs without a port filter, so a
  port-A caller could splice a foreign-port id and surface that
  tenant's clientName, mooringNumber, or yacht ownership on read.
  New assertInterestFksInPort helper guards all three surfaces.

- clients.service.createRelationship: accepted clientBId from the
  body without a port check; the relationship list endpoint joins
  clients without filtering by port, so the foreign client's name
  + email would render in the relationships tab. Now verifies
  clientBId belongs to portId and rejects self-relationships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/services/clients.service.ts

@@ -13,7 +13,7 @@ import { yachts } from '@/lib/db/schema/yachts';
 import { berthReservations } from '@/lib/db/schema/reservations';
 import { tags } from '@/lib/db/schema/system';
 import { createAuditLog, type AuditMeta } from '@/lib/audit';
-import { NotFoundError } from '@/lib/errors';
+import { NotFoundError, ValidationError } from '@/lib/errors';
 import { isPortalEnabledForPort } from '@/lib/services/portal-auth.service';
 import { setEntityTags } from '@/lib/services/entity-tags.helper';
 import { emitToRoom } from '@/lib/socket/server';
@@ -663,11 +663,24 @@ export async function createRelationship(
   data: { clientBId: string; relationshipType: string; description?: string },
   meta: AuditMeta,
 ) {
+  if (data.clientBId === clientId) {
+    throw new ValidationError('A client cannot have a relationship to themselves');
+  }
+
   const client = await db.query.clients.findFirst({
     where: eq(clients.id, clientId),
   });
   if (!client || client.portId !== portId) throw new NotFoundError('Client');
 
+  // Tenant scope: clientBId arrives from the request body. Without this check
+  // a port-A caller could splice a port-B client UUID onto their own client's
+  // relationship row; the GET handler joins clientRelationships → clients with
+  // no port filter and would surface the foreign client's name + email.
+  const otherClient = await db.query.clients.findFirst({
+    where: and(eq(clients.id, data.clientBId), eq(clients.portId, portId)),
+  });
+  if (!otherClient) throw new ValidationError('clientBId not found in this port');
+
   const [rel] = await db
     .insert(clientRelationships)
     .values({ portId, clientAId: clientId, ...data })