refactor(infra-billing): dedupe the site-ownership check shared by GET and PORTAL

[pedrofrxncx]

Source: C1 duplication — apps/api/src/tools/infra-billing/get.ts and portal.ts each contained the identical 8-line block (lowercase+dedupe requested slugs, load the org's owned slugs, reject any unowned slug) verbatim.

Payoff: one home for a security-relevant check (this is the gate that stops one org reading another org's infra usage/plan/invoices by guessing a site slug) means a future fix to it can't be applied to one call site and missed in the other.

Change: extracted the block into resolveOwnedSlugs(ctx, orgId, siteSlugs) in a new apps/api/src/tools/infra-billing/ownership.ts, and call it from both tools. Byte-identical logic, just relocated — no behavior change. Net diff: -20 duplicated lines / +23 shared-helper lines (one-time cost, future callers add zero).

Verify: cd apps/api && bunx tsc --noEmit (clean) and bun test apps/api/src/deco-legacy/infra-billing.test.ts (32 pass, unchanged) confirm nothing about the ownership check's behavior moved.

Checks run locally: bun run fmt, bunx tsc --noEmit (apps/api), bun test apps/api/src/deco-legacy/infra-billing.test.ts, bunx oxlint on the 3 changed files — all clean. Full CI validates the rest.

---

Summary by cubic

Deduplicates the infra-billing site-ownership check used by GET and PORTAL into a shared helper, keeping behavior identical. Centralizing this security gate avoids divergence and ensures fixes apply to both endpoints.

• Add resolveOwnedSlugs(ctx, orgId, siteSlugs) in apps/api/src/tools/infra-billing/ownership.ts (lowercase + dedupe, load owned slugs, throw on unowned; returns slugs and ownedSlugs).
• Replace inline checks in apps/api/src/tools/infra-billing/get.ts and apps/api/src/tools/infra-billing/portal.ts with the helper.
• No behavior change; tests and type checks unchanged. No rollout or migration actions.

^{Written for commit 9bfaca0. Summary will update on new commits.}