feat(portfolios): persist and validate daemon assignment on create/update

POST /v1/portfolios now forwards a non-null managed_by_daemon_id into
create persistence, and both create and PATCH apply the same daemon
validation contract (UUID format -> 422, missing/foreign -> 404,
inactive -> 409, admin target-owner basis). Daemon validation locks the
daemon row FOR SHARE inside the portfolio write transaction so
validation and write form one atomic decision boundary.

Adds domain errors, repository protocol/signature updates, API/PostgreSQL
tests (POST->GET persistence, no partial state on failure, assignment vs
deactivation race), and contract/data-model documentation.

app/domain/errors.py

@@ -1,4 +1,4 @@
-"""Shared strategy-catalog domain errors used across API, service, and persistence layers."""
+"""Shared domain errors used across API, service, and persistence layers."""
 
 
 class StrategyNotFoundError(ValueError):
@@ -7,3 +7,11 @@ class StrategyNotFoundError(ValueError):
 
 class StrategyInactiveError(ValueError):
     """Raised when a new portfolio selection targets an inactive strategy."""
+
+
+class DaemonNotFoundError(ValueError):
+    """Raised when a referenced daemon ID does not exist or is not owned by the portfolio owner."""
+
+
+class DaemonInactiveError(ValueError):
+    """Raised when a new portfolio assignment targets an inactive daemon."""