feat(13-06): getTender include sources[] (SCHEMA-03 read surface)

GET /modules/tender-radar/:id now includes the TenderSource relation
(sourcePortal, sourceUrl, sourceNoticeId) so a cross-source-deduped
tender's detail response carries links to all its source portals, not
just the single primary sourceUrl column. Route order unchanged (:id
stays after all static routes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/tenders.controller.spec.ts

@@ -24,6 +24,18 @@ function makeFakePrisma() {
     title: 'Beispielausschreibung',
     status: 'active',
     sourcePortal: 'doe-opendata',
+    sources: [
+      {
+        sourcePortal: 'doe-opendata',
+        sourceUrl: 'https://doe.example/t1',
+        sourceNoticeId: 'doe-1',
+      },
+      {
+        sourcePortal: 'cosinex-dtvp',
+        sourceUrl: 'https://dtvp.example/t1',
+        sourceNoticeId: 'dtvp-1',
+      },
+    ],
   });
   const configs = new Map<string, any>();
   configs.set('doe-opendata', {
@@ -147,6 +159,40 @@ describe('TendersController — global read (not tenant-scoped)', () => {
     expect(callArgs.where).toEqual({ id: 't1' });
   });
 
+  it('GET /:id includes the sources relation so the response carries all TenderSource links (13-06, SCHEMA-03)', async () => {
+    const prisma = makeFakePrisma();
+    const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;
+    const triageService = makeFakeTriageService();
+    const controller = new TendersController(
+      prisma as any,
+      scheduler,
+      triageService as any,
+      makeFakeSavedSearchService() as any,
+      makeFakeNotificationPrefService() as any,
+    );
+
+    const result = await controller.getTender('t1');
+
+    const callArgs = prisma.tender.findUnique.mock.calls[0][0];
+    expect(callArgs.include).toEqual({
+      sources: {
+        select: { sourcePortal: true, sourceUrl: true, sourceNoticeId: true },
+      },
+    });
+    expect(result.sources).toEqual([
+      {
+        sourcePortal: 'doe-opendata',
+        sourceUrl: 'https://doe.example/t1',
+        sourceNoticeId: 'doe-1',
+      },
+      {
+        sourcePortal: 'cosinex-dtvp',
+        sourceUrl: 'https://dtvp.example/t1',
+        sourceNoticeId: 'dtvp-1',
+      },
+    ]);
+  });
+
   it('GET /:id throws NotFoundException for a missing id', async () => {
     const prisma = makeFakePrisma();
     const scheduler = { setInterval: vi.fn(), stopJob: vi.fn() } as any;