Resolve one-off casing dual-reads (portal source, attachment URL)

[mocha06]

Part of the "Typed payloads: parse, don't validate" milestone. Follows #416 / PR #417.

Problem — small, batched one-offs

Remaining casing dual-reads that don't belong to a larger domain:

• services/portal_service.py: source.get("repoId") or source.get("repo_uuid") or source.get("repoUuid") — a three-way alias on a portal element data-lookup source. Introspect the relevant portal element input/output type in-issue and canonicalize.
• cli/commands/_common.py: node.get("fileURL") or node.get("fileUrl") — response-side attachment URL. Confirm the query's selected field name and read one.

Explicitly out of scope (not casing aliases — leave as-is)

• auth/resource_server.py: claims.get("azp") or claims.get("client_id") or claims.get("sub") — JWT claim precedence, deliberate.
• cli/commands/agent.py: payload.get("error") or payload.get("message") — error-message fallback, deliberate.
• mcp/tools/ai_tool_helpers.py: b.get("eventId") or b.get("event_id") — sanctioned lenient fallback in the _summarize_behaviors error handler (see 0. Prep: parse behavior actionParams into typed models #416).

Acceptance

• The two casing dual-reads resolved to a single declared name each (introspect to confirm which).
• uv run pytest -m "not integration" + ruff + import-linter green.