feat(11-05): implement TenderTriageService (GREEN) + apply migration

TenderTriageService upserts per-user read/favourite state on the
@@unique([userId,tenderId]) target (idempotent), scopes every query by
userId (V4/IDOR, FavoritesService pattern), and exposes favoriteIds() for
the upcoming favOnly filter. Migration 20260721160000_add_tender_triage
applied to the local dev DB (FK ON DELETE CASCADE verified via \d),
Prisma client regenerated. All 8 spec cases green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/tender-triage.service.spec.ts

@@ -139,7 +139,7 @@ describe('TenderTriageService', () => {
     const service = new TenderTriageService(prisma as any);
 
     await service.setTriage('u1', 'tenant1', 't1', { isFavorite: true });
-    (prisma as any)._simulateTenderCascadeDelete('t1');
+    prisma.tenderTriage._simulateTenderCascadeDelete('t1');
 
     expect(await service.listForUser('u1', ['t1'])).toHaveLength(0);
     expect(await service.favoriteIds('u1')).toEqual([]);