Phase D (D1): enqueue a PORTFOLIO backtest over 2..8 of the caller's OWN saved strategies, combining them into one honest book view (combined equity/drawdown, correlation matrix, overlap, contributions, concentration).

Body: {strategy_ids: [int, ...]} — bounds 2..8 and distinctness are enforced by the request model (422 otherwise). Ownership is enforced HERE per id:

• no such strategy id → 404
• strategy owned by another user → 403 (never leaks its contents) Auth: session cookie wins, else X-Vega-Key (require_backtest_submitter), matching the single-backtest surface. Reuses the job/poll machinery: a row is created (kind='portfolio'), a background task runs + combines, and the run is polled via the SAME GET /v1/backtests/{run_id}.