feat(portfolios): persist and validate daemon assignment on create/update

POST /v1/portfolios now forwards a non-null managed_by_daemon_id into
create persistence, and both create and PATCH apply the same daemon
validation contract (UUID format -> 422, missing/foreign -> 404,
inactive -> 409, admin target-owner basis). Daemon validation locks the
daemon row FOR SHARE inside the portfolio write transaction so
validation and write form one atomic decision boundary.

Adds domain errors, repository protocol/signature updates, API/PostgreSQL
tests (POST->GET persistence, no partial state on failure, assignment vs
deactivation race), and contract/data-model documentation.

app/repositories/portfolio_repository.py

@@ -162,6 +162,7 @@ class PortfolioRepository(Protocol):
         profit_buffer: float,
         active_strategy_id: str | None,
         avabile_strategies: list[str] | None,
+        managed_by_daemon_id: str | None = None,
     ) -> Portfolio: ...
 
     def get_asset_by_id(self, asset_id: str) -> Asset | None: ...