fix: link project to its portal client (project.client_id) so the portal isn't empty

Caught by adversarial review of the scope test: portal_client_for_project minted a
dedicated client but never set project.client_id, so the client-scoped routes found
no projects — every location 404'd, including the client's own (empty portal). Now
links the project + adds a positive-case test.

tests/test_portal_auth_helpers.py

@@ -11,6 +11,8 @@ def test_portal_client_for_project_is_1to1_and_idempotent(db_session):
     assert isinstance(c1, Client) and c1.id == c2.id
     assert c1.slug == f"portal-{p.id}"
     assert db_session.query(Client).filter_by(slug=f"portal-{p.id}").count() == 1
+    # the project must be linked to its portal client, or client-scoped routes find nothing
+    assert p.client_id == c1.id
 
 
 def test_mint_portal_session_returns_usable_token_id(db_session):