fix: retrofit License.vendor to vendorId FK + createLicense error handling

License.vendor (free-text string) is now vendorId, a required FK to
Vendor, per docs/asset-license-management.md's "## Vendor (chốt
2026-08-02)" spec. Mirrors the Request.employeeId string->FK precedent:
Zod validates UUID format only, Prisma's own FK constraint (P2003) is
caught at insert time and translated into a clean 400 instead of a raw
500. No License data existed yet, so this is a pure column-type
migration, no backfill needed.

Also converts createLicense() to the {ok,value}|{ok,error} result
pattern used elsewhere (createRequest, createAssetItem) instead of
returning a bare LicenseRecord promise - closes the gap flagged in
CLAUDE.md now that License has its first FK-violation error case to
handle.

src/app/api/licenses/route.ts

@@ -22,10 +22,10 @@ export async function POST(request: Request): Promise<NextResponse> {
     return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
   }
 
-  const { name, vendor, seatsTotal, expiryDate, licenseType } = body as Record<string, unknown>;
+  const { name, vendorId, seatsTotal, expiryDate, licenseType } = body as Record<string, unknown>;
   const validation = validateCreateLicenseInput({
     name,
-    vendor,
+    vendorId,
     seatsTotal,
     expiryDate,
     licenseType,
@@ -36,7 +36,10 @@ export async function POST(request: Request): Promise<NextResponse> {
   }
 
   const created = await createLicense(validation.value);
-  return NextResponse.json(created, { status: 201 });
+  if (!created.ok) {
+    return NextResponse.json({ error: created.error }, { status: 400 });
+  }
+  return NextResponse.json(created.value, { status: 201 });
 }
 
 export async function GET(): Promise<NextResponse> {