feat(05-02): portal authentication via subscriber account number

- Add passwordHash field to Subscriber model (nullable for existing subscribers)
- Add portal-credentials NextAuth provider (accountNumber + password + tenantId)
- Persist subscriberId in JWT token and session for portal user identification
- Extend next-auth types with optional subscriberId on Session, User, and JWT
- Exclude /portal/login and /api/portal/auth from middleware auth requirement

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

prisma/schema.prisma

@@ -329,6 +329,8 @@ model Subscriber {
   cancelledAt   DateTime?
   /// Per-subscriber auto-suspend override (null = use TenantSettings.autoSuspendDays)
   autoSuspendDays Int?
+  /// Hashed password for portal login — nullable because existing subscribers may not have portal access
+  passwordHash  String?
   notes         String?
   /// Overpayment credit balance — always updated atomically with journal entries.
   /// This is NOT a stored ledger balance; it tracks credits for the FIFO allocation