feat: add MFA/TOTP auth, PII encryption, agents/leads/inquiries modules, and comprehensive tests

- Add TOTP-based MFA with setup, verify, disable, backup codes, and challenge flow
- Add PII field encryption middleware with AES-256-GCM and deterministic search hashes
- Add agents, inquiries, and leads domain modules with entities, events, value objects
- Add web dashboard pages for inquiries and leads with detail dialogs
- Add 30+ component tests (valuation, charts, listings, search, providers, UI)
- Add Prisma migrations for encryption hash columns and MFA TOTP support
- Fix all ESLint errors (unused imports, duplicate imports, lint auto-fixes)
- Update dependencies and lock file
- Clean up obsolete exploration/QA docs, add audit documentation

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/components/leads/__tests__/lead-status-badge.spec.tsx

@@ -0,0 +1,41 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import { LeadStatusBadge } from '../lead-status-badge';
+
+describe('LeadStatusBadge', () => {
+  it('renders NEW status with correct label', () => {
+    render(<LeadStatusBadge status="NEW" />);
+    expect(screen.getByText('Mới')).toBeInTheDocument();
+  });
+
+  it('renders CONTACTED status with correct label', () => {
+    render(<LeadStatusBadge status="CONTACTED" />);
+    expect(screen.getByText('Đã liên hệ')).toBeInTheDocument();
+  });
+
+  it('renders QUALIFIED status with correct label', () => {
+    render(<LeadStatusBadge status="QUALIFIED" />);
+    expect(screen.getByText('Đủ điều kiện')).toBeInTheDocument();
+  });
+
+  it('renders NEGOTIATING status with correct label', () => {
+    render(<LeadStatusBadge status="NEGOTIATING" />);
+    expect(screen.getByText('Đang thương lượng')).toBeInTheDocument();
+  });
+
+  it('renders CONVERTED status with correct label', () => {
+    render(<LeadStatusBadge status="CONVERTED" />);
+    expect(screen.getByText('Chuyển đổi')).toBeInTheDocument();
+  });
+
+  it('renders LOST status with correct label', () => {
+    render(<LeadStatusBadge status="LOST" />);
+    expect(screen.getByText('Mất')).toBeInTheDocument();
+  });
+
+  it('falls back to raw status value for unknown status', () => {
+    // @ts-expect-error testing unknown status
+    render(<LeadStatusBadge status="UNKNOWN" />);
+    expect(screen.getByText('UNKNOWN')).toBeInTheDocument();
+  });
+});