feat: add MFA/TOTP auth, PII encryption, agents/leads/inquiries modules, and comprehensive tests

- Add TOTP-based MFA with setup, verify, disable, backup codes, and challenge flow
- Add PII field encryption middleware with AES-256-GCM and deterministic search hashes
- Add agents, inquiries, and leads domain modules with entities, events, value objects
- Add web dashboard pages for inquiries and leads with detail dialogs
- Add 30+ component tests (valuation, charts, listings, search, providers, UI)
- Add Prisma migrations for encryption hash columns and MFA TOTP support
- Fix all ESLint errors (unused imports, duplicate imports, lint auto-fixes)
- Update dependencies and lock file
- Clean up obsolete exploration/QA docs, add audit documentation

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/components/leads/__tests__/create-lead-dialog.spec.tsx

@@ -0,0 +1,103 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+import { CreateLeadDialog } from '../create-lead-dialog';
+
+// Mock the hook
+const mockMutate = vi.fn();
+vi.mock('@/lib/hooks/use-leads', () => ({
+  useCreateLead: () => ({
+    mutate: mockMutate,
+    isPending: false,
+  }),
+}));
+
+// Mock Dialog components with simplified versions
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ children, open }: { children: React.ReactNode; open: boolean }) =>
+    open ? <div data-testid="dialog">{children}</div> : null,
+  DialogContent: ({ children, className }: { children: React.ReactNode; className?: string }) => (
+    <div data-testid="dialog-content" className={className}>{children}</div>
+  ),
+  DialogHeader: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DialogTitle: ({ children }: { children: React.ReactNode }) => <h2>{children}</h2>,
+  DialogDescription: ({ children }: { children: React.ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+}));
+
+describe('CreateLeadDialog', () => {
+  beforeEach(() => {
+    mockMutate.mockClear();
+  });
+
+  it('renders dialog when open', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Thêm lead mới')).toBeInTheDocument();
+  });
+
+  it('does not render when closed', () => {
+    render(<CreateLeadDialog open={false} onOpenChange={vi.fn()} />);
+    expect(screen.queryByText('Thêm lead mới')).not.toBeInTheDocument();
+  });
+
+  it('renders customer name input', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Tên khách hàng *')).toBeInTheDocument();
+  });
+
+  it('renders phone input', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Số điện thoại *')).toBeInTheDocument();
+  });
+
+  it('renders email input', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Email')).toBeInTheDocument();
+  });
+
+  it('renders source select', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Nguồn')).toBeInTheDocument();
+  });
+
+  it('renders score input', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Điểm (0-100)')).toBeInTheDocument();
+  });
+
+  it('renders notes textarea', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByLabelText('Ghi chú')).toBeInTheDocument();
+  });
+
+  it('renders cancel and submit buttons', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Hủy')).toBeInTheDocument();
+    expect(screen.getByText('Tạo lead')).toBeInTheDocument();
+  });
+
+  it('calls onOpenChange when cancel clicked', async () => {
+    const user = userEvent.setup();
+    const onOpenChange = vi.fn();
+    render(<CreateLeadDialog open={true} onOpenChange={onOpenChange} />);
+
+    await user.click(screen.getByText('Hủy'));
+    expect(onOpenChange).toHaveBeenCalledWith(false);
+  });
+
+  it('calls mutate when form is submitted', async () => {
+    const user = userEvent.setup();
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+
+    await user.type(screen.getByLabelText('Tên khách hàng *'), 'Nguyễn Văn Test');
+    await user.type(screen.getByLabelText('Số điện thoại *'), '0901234567');
+    await user.click(screen.getByText('Tạo lead'));
+
+    expect(mockMutate).toHaveBeenCalled();
+  });
+
+  it('renders description text', () => {
+    render(<CreateLeadDialog open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Nhập thông tin khách hàng tiềm năng')).toBeInTheDocument();
+  });
+});

apps/web/components/leads/__tests__/lead-detail-dialog.spec.tsx

@@ -0,0 +1,139 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+import type { LeadReadDto } from '@/lib/leads-api';
+import { LeadDetailDialog } from '../lead-detail-dialog';
+
+// Mock hooks
+const mockUpdateMutate = vi.fn();
+const mockDeleteMutate = vi.fn();
+vi.mock('@/lib/hooks/use-leads', () => ({
+  useUpdateLeadStatus: () => ({
+    mutate: mockUpdateMutate,
+    isPending: false,
+  }),
+  useDeleteLead: () => ({
+    mutate: mockDeleteMutate,
+    isPending: false,
+  }),
+}));
+
+// Mock Dialog components
+vi.mock('@/components/ui/dialog', () => ({
+  Dialog: ({ children, open }: { children: React.ReactNode; open: boolean }) =>
+    open ? <div data-testid="dialog">{children}</div> : null,
+  DialogContent: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DialogHeader: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+  DialogTitle: ({ children }: { children: React.ReactNode }) => <h2>{children}</h2>,
+  DialogDescription: ({ children }: { children: React.ReactNode }) => <p>{children}</p>,
+  DialogFooter: ({ children }: { children: React.ReactNode }) => <div>{children}</div>,
+}));
+
+const mockLead: LeadReadDto = {
+  id: 'lead-1',
+  agentId: 'agent-1',
+  name: 'Trần Thị B',
+  phone: '0987654321',
+  email: 'tran@example.com',
+  source: 'website',
+  score: 75,
+  notes: { text: 'Quan tâm căn hộ Quận 7' },
+  status: 'NEW',
+  createdAt: '2026-01-15T10:00:00Z',
+  updatedAt: '2026-01-16T14:00:00Z',
+};
+
+describe('LeadDetailDialog', () => {
+  beforeEach(() => {
+    mockUpdateMutate.mockClear();
+    mockDeleteMutate.mockClear();
+  });
+
+  it('returns null when lead is null', () => {
+    const { container } = render(
+      <LeadDetailDialog lead={null} open={true} onOpenChange={vi.fn()} />,
+    );
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('renders dialog title', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Chi tiết lead')).toBeInTheDocument();
+  });
+
+  it('renders lead name', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    // Name appears in both the description and the contact card
+    expect(screen.getAllByText('Trần Thị B').length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('renders phone number', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText(/0987654321/)).toBeInTheDocument();
+  });
+
+  it('renders email when present', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText(/tran@example.com/)).toBeInTheDocument();
+  });
+
+  it('renders score', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('75/100')).toBeInTheDocument();
+  });
+
+  it('renders notes', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Quan tâm căn hộ Quận 7')).toBeInTheDocument();
+  });
+
+  it('renders quick contact links', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    // Emoji prefixed text
+    const content = document.body.textContent;
+    expect(content).toContain('Gọi điện');
+    expect(content).toContain('Zalo');
+  });
+
+  it('renders Zalo link with correct phone format', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    const links = document.querySelectorAll('a[href*="zalo.me"]');
+    expect(links.length).toBeGreaterThan(0);
+    expect(links[0]).toHaveAttribute('href', 'https://zalo.me/84987654321');
+  });
+
+  it('renders delete button', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Xóa lead')).toBeInTheDocument();
+  });
+
+  it('shows confirmation on first delete click', async () => {
+    const user = userEvent.setup();
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+
+    await user.click(screen.getByText('Xóa lead'));
+    expect(screen.getByText('Xác nhận xóa?')).toBeInTheDocument();
+  });
+
+  it('renders close button', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Đóng')).toBeInTheDocument();
+  });
+
+  it('renders status change select', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Chuyển trạng thái')).toBeInTheDocument();
+  });
+
+  it('renders timeline section', () => {
+    render(<LeadDetailDialog lead={mockLead} open={true} onOpenChange={vi.fn()} />);
+    expect(screen.getByText('Lịch sử')).toBeInTheDocument();
+  });
+
+  it('hides email contact when email is null', () => {
+    const leadNoEmail = { ...mockLead, email: null };
+    render(<LeadDetailDialog lead={leadNoEmail} open={true} onOpenChange={vi.fn()} />);
+    const content = document.body.textContent;
+    expect(content).not.toContain('tran@example.com');
+  });
+});

apps/web/components/leads/__tests__/lead-status-badge.spec.tsx

@@ -0,0 +1,41 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import { LeadStatusBadge } from '../lead-status-badge';
+
+describe('LeadStatusBadge', () => {
+  it('renders NEW status with correct label', () => {
+    render(<LeadStatusBadge status="NEW" />);
+    expect(screen.getByText('Mới')).toBeInTheDocument();
+  });
+
+  it('renders CONTACTED status with correct label', () => {
+    render(<LeadStatusBadge status="CONTACTED" />);
+    expect(screen.getByText('Đã liên hệ')).toBeInTheDocument();
+  });
+
+  it('renders QUALIFIED status with correct label', () => {
+    render(<LeadStatusBadge status="QUALIFIED" />);
+    expect(screen.getByText('Đủ điều kiện')).toBeInTheDocument();
+  });
+
+  it('renders NEGOTIATING status with correct label', () => {
+    render(<LeadStatusBadge status="NEGOTIATING" />);
+    expect(screen.getByText('Đang thương lượng')).toBeInTheDocument();
+  });
+
+  it('renders CONVERTED status with correct label', () => {
+    render(<LeadStatusBadge status="CONVERTED" />);
+    expect(screen.getByText('Chuyển đổi')).toBeInTheDocument();
+  });
+
+  it('renders LOST status with correct label', () => {
+    render(<LeadStatusBadge status="LOST" />);
+    expect(screen.getByText('Mất')).toBeInTheDocument();
+  });
+
+  it('falls back to raw status value for unknown status', () => {
+    // @ts-expect-error testing unknown status
+    render(<LeadStatusBadge status="UNKNOWN" />);
+    expect(screen.getByText('UNKNOWN')).toBeInTheDocument();
+  });
+});