fix(api): replace lte() with inArray() in portal queries — data leak

CRITICAL data leak: portal queries used lte(id, maxId) to fetch related
entities, which returned ALL records with ID ≤ maxId — leaking other clients'
pets, staff, and invoice line items.

Fixed all three occurrences:
- pets: lte(pets.id, maxId) → inArray(pets.id, petIds)
- staff: lte(staff.id, maxId) → inArray(staff.id, staffIds)
- invoiceLineItems: lte(invoiceId, maxId) → inArray(invoiceId, invoiceIds)

Also added inArray to @groombook/db re-exports from drizzle-orm.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/db/src/index.ts

@@ -3,7 +3,7 @@ import postgres from "postgres";
 import * as schema from "./schema.js";
 
 export * from "./schema.js";
-export { and, asc, desc, eq, exists, gte, gt, ilike, lt, lte, ne, or, sql } from "drizzle-orm";
+export { and, asc, desc, eq, exists, gte, gt, ilike, inArray, lt, lte, ne, or, sql } from "drizzle-orm";
 
 let _db: ReturnType<typeof drizzle> | null = null;