feat(14-04): denylisted-portals read endpoint sourced from DENYLISTED_PORTALS

- Add PORTAL_URLS map (vergabe24, aumass) in source-registry.ts, keyed off
  the existing DENYLISTED_PORTALS constant so the portal set is never
  re-declared
- Add GET /modules/tender-radar/denylisted-portals, declared before
  @Get(':id') (route-order pitfall), mapping over DENYLISTED_PORTALS
- Extend tenders.controller.spec.ts: response shape + route-order guard

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/api/src/tenders/source-registry.ts

@@ -11,6 +11,19 @@ import type { TenderSourceAdapter } from './adapters/tender-source-adapter.inter
  */
 export const DENYLISTED_PORTALS = ['vergabe24', 'aumass'] as const;
 
+/**
+ * Canonical direct-link URL per denylisted portal (UI-06/D-12). Keyed by
+ * the same portal slugs as `DENYLISTED_PORTALS` — the portal SET is never
+ * re-declared here, only the URL each already-listed portal maps to.
+ * `TendersController.getDenylistedPortals()` maps over `DENYLISTED_PORTALS`
+ * and looks up each entry's URL here, so a future denylist addition needs
+ * only a URL added to this map (not a second hardcoded list anywhere else).
+ */
+export const PORTAL_URLS: Record<(typeof DENYLISTED_PORTALS)[number], string> = {
+  vergabe24: 'https://www.vergabe24.de',
+  aumass: 'https://www.aumass.de',
+};
+
 /**
  * Thrown by `SourceRegistry.register()` when an adapter declares a
  * denylisted portal. Proves Erfolgskriterium 4 (13-CONTEXT.md D-06) —