State each family part's cardinality and refuse a family write that breaks it

A family model's Parts table gains a cardinality column: one for a part every convention fills, optional for a part it fills at most once, and a group for parts that are alternatives, as the tenor basis swap's are. The generated family put refuses a write whose parts break it, with a validation verdict that names the part.

The unique index on (tenant_id, convention_id) stops two rows of one part, but nothing stops a missing required part. The family put accepts a commodity future with no contract terms, or a cross currency swap with no leg. The ORE export then refuses that convention, and the failure surfaces far from the write that caused it. Each composite kind states its rule only in its ORE mapper today: reverse_commodity_future, reverse_cross_currency_basis and reverse_cross_currency_fix_float throw when a part is missing.

• projects/ores.refdata/modeling/ores.refdata.commodity_future_convention.org, the Parts table.
• The generated commodity_future_convention_service.cpp, whose put checks no part count.
• Split the conventions that are still flat — where the gap was found.