Hardened Finance Fences in Client Portals

Deepened row-level guards around finance records: portal members can only ever read or write rows inside their own workspace, verified by a dedicated test suite that tries to forge its way across tenants and fails.