feat(05-03): portal ticket API routes, payment scaffold, and tests

- GET/POST /api/portal/tickets for listing and creating tickets
- GET /api/portal/tickets/[id] for ticket detail with conversation
- GET/POST /api/portal/tickets/[id]/comments for conversation threads
- GET /api/portal/payments/coming-soon returns outstanding balance and payment instructions
- 6 integration tests: SUBSCRIBER source, staff visibility, isolation, comments, closed rejection, thread ordering

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/app/api/portal/tickets/route.ts

@@ -0,0 +1,46 @@
+/**
+ * GET /api/portal/tickets — List subscriber's tickets (paginated)
+ * POST /api/portal/tickets — Create a new support ticket
+ */
+
+import { NextRequest, NextResponse } from "next/server";
+import { withPortalAuth } from "@/lib/middleware/portal-auth";
+import {
+  createPortalTicket,
+  listPortalTickets,
+} from "@/lib/services/portal-ticket-service";
+
+export const GET = withPortalAuth(async (req, { subscriberId, tenantPrisma }) => {
+  const { searchParams } = new URL(req.url);
+  const page = parseInt(searchParams.get("page") || "1", 10);
+  const limit = parseInt(searchParams.get("limit") || "20", 10);
+
+  const result = await listPortalTickets(tenantPrisma, subscriberId, { page, limit });
+
+  return NextResponse.json(result);
+});
+
+export const POST = withPortalAuth(async (req, { subscriberId, tenantId, tenantPrisma }) => {
+  const body = await req.json();
+  const { categoryId, subject, description } = body;
+
+  if (!categoryId || !subject || !description) {
+    return NextResponse.json(
+      { error: "categoryId, subject, and description are required" },
+      { status: 400 }
+    );
+  }
+
+  try {
+    const ticket = await createPortalTicket(tenantPrisma, tenantId, subscriberId, {
+      categoryId,
+      subject,
+      description,
+    });
+
+    return NextResponse.json(ticket, { status: 201 });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NextResponse.json({ error: message }, { status: 400 });
+  }
+});