feat: add MFA/TOTP auth, PII encryption, agents/leads/inquiries modules, and comprehensive tests

- Add TOTP-based MFA with setup, verify, disable, backup codes, and challenge flow
- Add PII field encryption middleware with AES-256-GCM and deterministic search hashes
- Add agents, inquiries, and leads domain modules with entities, events, value objects
- Add web dashboard pages for inquiries and leads with detail dialogs
- Add 30+ component tests (valuation, charts, listings, search, providers, UI)
- Add Prisma migrations for encryption hash columns and MFA TOTP support
- Fix all ESLint errors (unused imports, duplicate imports, lint auto-fixes)
- Update dependencies and lock file
- Clean up obsolete exploration/QA docs, add audit documentation

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/components/providers/__tests__/auth-provider.spec.tsx

@@ -0,0 +1,45 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { AuthProvider } from '../auth-provider';
+
+const mockInitialize = vi.fn();
+
+vi.mock('@/lib/auth-store', () => ({
+  useAuthStore: (selector: (state: { initialize: () => void }) => unknown) =>
+    selector({ initialize: mockInitialize }),
+}));
+
+describe('AuthProvider', () => {
+  beforeEach(() => {
+    mockInitialize.mockClear();
+  });
+
+  it('renders children', () => {
+    render(
+      <AuthProvider>
+        <div>Child content</div>
+      </AuthProvider>,
+    );
+    expect(screen.getByText('Child content')).toBeInTheDocument();
+  });
+
+  it('calls initialize on mount', () => {
+    render(
+      <AuthProvider>
+        <div>Test</div>
+      </AuthProvider>,
+    );
+    expect(mockInitialize).toHaveBeenCalled();
+  });
+
+  it('renders multiple children', () => {
+    render(
+      <AuthProvider>
+        <div>Child 1</div>
+        <div>Child 2</div>
+      </AuthProvider>,
+    );
+    expect(screen.getByText('Child 1')).toBeInTheDocument();
+    expect(screen.getByText('Child 2')).toBeInTheDocument();
+  });
+});

apps/web/components/providers/__tests__/theme-provider.spec.tsx

@@ -0,0 +1,125 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { describe, expect, it, vi } from 'vitest';
+import { ThemeProvider, useTheme } from '../theme-provider';
+
+// Provide a working localStorage mock for this test file
+const localStorageMock = (() => {
+  let store: Record<string, string> = {};
+  return {
+    getItem: vi.fn((key: string) => store[key] ?? null),
+    setItem: vi.fn((key: string, value: string) => { store[key] = value; }),
+    removeItem: vi.fn((key: string) => { delete store[key]; }),
+    clear: vi.fn(() => { store = {}; }),
+    get length() { return Object.keys(store).length; },
+    key: vi.fn((index: number) => Object.keys(store)[index] ?? null),
+  };
+})();
+
+Object.defineProperty(globalThis, 'localStorage', { value: localStorageMock, writable: true });
+
+// Mock window.matchMedia (not implemented in jsdom)
+Object.defineProperty(window, 'matchMedia', {
+  writable: true,
+  value: vi.fn().mockImplementation((query: string) => ({
+    matches: false,
+    media: query,
+    onchange: null,
+    addListener: vi.fn(),
+    removeListener: vi.fn(),
+    addEventListener: vi.fn(),
+    removeEventListener: vi.fn(),
+    dispatchEvent: vi.fn(),
+  })),
+});
+
+// Test consumer component
+function ThemeConsumer() {
+  const { theme, toggleTheme } = useTheme();
+  return (
+    <div>
+      <span data-testid="theme">{theme}</span>
+      <button onClick={toggleTheme}>Toggle</button>
+    </div>
+  );
+}
+
+describe('ThemeProvider', () => {
+  beforeEach(() => {
+    document.documentElement.classList.remove('dark');
+    localStorageMock.clear();
+    vi.clearAllMocks();
+  });
+
+  it('renders children', () => {
+    render(
+      <ThemeProvider>
+        <div>Child content</div>
+      </ThemeProvider>,
+    );
+    expect(screen.getByText('Child content')).toBeInTheDocument();
+  });
+
+  it('defaults to light theme', () => {
+    render(
+      <ThemeProvider>
+        <ThemeConsumer />
+      </ThemeProvider>,
+    );
+    expect(screen.getByTestId('theme')).toHaveTextContent('light');
+  });
+
+  it('toggles theme to dark', async () => {
+    const user = userEvent.setup();
+    render(
+      <ThemeProvider>
+        <ThemeConsumer />
+      </ThemeProvider>,
+    );
+
+    await user.click(screen.getByText('Toggle'));
+    expect(screen.getByTestId('theme')).toHaveTextContent('dark');
+  });
+
+  it('toggles theme back to light', async () => {
+    const user = userEvent.setup();
+    render(
+      <ThemeProvider>
+        <ThemeConsumer />
+      </ThemeProvider>,
+    );
+
+    await user.click(screen.getByText('Toggle'));
+    await user.click(screen.getByText('Toggle'));
+    expect(screen.getByTestId('theme')).toHaveTextContent('light');
+  });
+
+  it('persists theme to localStorage', async () => {
+    const user = userEvent.setup();
+    render(
+      <ThemeProvider>
+        <ThemeConsumer />
+      </ThemeProvider>,
+    );
+
+    await user.click(screen.getByText('Toggle'));
+    expect(localStorageMock.setItem).toHaveBeenCalledWith('goodgo-theme', 'dark');
+  });
+
+  it('loads stored theme from localStorage', () => {
+    localStorageMock.getItem.mockReturnValueOnce('dark');
+    render(
+      <ThemeProvider>
+        <ThemeConsumer />
+      </ThemeProvider>,
+    );
+    expect(screen.getByTestId('theme')).toHaveTextContent('dark');
+  });
+});
+
+describe('useTheme', () => {
+  it('returns default values outside provider', () => {
+    render(<ThemeConsumer />);
+    expect(screen.getByTestId('theme')).toHaveTextContent('light');
+  });
+});

apps/web/components/providers/__tests__/web-vitals.spec.tsx

@@ -0,0 +1,29 @@
+import { render } from '@testing-library/react';
+import { describe, expect, it, vi } from 'vitest';
+import { WebVitals } from '../web-vitals';
+
+// Mock web-vitals
+vi.mock('web-vitals', () => ({
+  onLCP: vi.fn(),
+  onFCP: vi.fn(),
+  onCLS: vi.fn(),
+  onTTFB: vi.fn(),
+  onINP: vi.fn(),
+}));
+
+// Mock the internal web-vitals lib
+vi.mock('@/lib/web-vitals', () => ({
+  reportWebVital: vi.fn(),
+  flushWebVitals: vi.fn(),
+}));
+
+describe('WebVitals', () => {
+  it('renders nothing (returns null)', () => {
+    const { container } = render(<WebVitals />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it('does not throw when rendered', () => {
+    expect(() => render(<WebVitals />)).not.toThrow();
+  });
+});