feat(11-05): GET/PUT /modules/tender-radar/triage routes + favOnly filter

Adds the batch-triage read/write routes (declared before @Get(':id') per
the route-order pitfall, T-11-13) and wires them through
TenderTriageService with userId/tenantId always derived from the request
context, never the body (T-11-10 / V4 IDOR). Extends TenderQueryDto/
buildTenderWhere with favOnly (UI-04): the controller resolves the
current user's favorited tenderIds server-side before building the
where-clause, and an empty favorites list yields zero matches instead of
the unfiltered catalog. Both batch-ids and favIds in-lists are bounded
(T-11-11 DoS). tenders.controller.spec.ts constructor calls updated for
the new TenderTriageService dependency (Rule 3 — required to keep the
existing suite compiling/passing).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/tenders.module.ts

@@ -7,6 +7,7 @@ import { seedTendersModule } from './tenders.seed';
 import { TenderIngestionService } from './tender-ingestion.service';
 import { TenderNormalizerService } from './tender-normalizer.service';
 import { TenderSchedulerService } from './tender-scheduler.service';
+import { TenderTriageService } from './tender-triage.service';
 import { TendersController } from './tenders.controller';
 
 /**
@@ -20,7 +21,8 @@ import { TendersController } from './tenders.controller';
  * D-05 retention) and the shared global scheduler. This plan (05) wires
  * TendersController: the global (ModuleGuard-gated, not tenant-scoped)
  * read surface plus the Roles-guarded admin source-config routes that
- * live-apply to TenderSchedulerService.
+ * live-apply to TenderSchedulerService. Plan 05 adds TenderTriageService
+ * (per-user gelesen/ungelesen + Favorit, UI-03/04) as a further provider.
  *
  * PrismaModule is global (no explicit import needed).
  *
@@ -35,6 +37,7 @@ import { TendersController } from './tenders.controller';
     TenderNormalizerService,
     TenderIngestionService,
     TenderSchedulerService,
+    TenderTriageService,
   ],
 })
 export class TendersModule implements OnModuleInit {