feat: add MFA/TOTP auth, PII encryption, agents/leads/inquiries modules, and comprehensive tests

- Add TOTP-based MFA with setup, verify, disable, backup codes, and challenge flow
- Add PII field encryption middleware with AES-256-GCM and deterministic search hashes
- Add agents, inquiries, and leads domain modules with entities, events, value objects
- Add web dashboard pages for inquiries and leads with detail dialogs
- Add 30+ component tests (valuation, charts, listings, search, providers, UI)
- Add Prisma migrations for encryption hash columns and MFA TOTP support
- Fix all ESLint errors (unused imports, duplicate imports, lint auto-fixes)
- Update dependencies and lock file
- Clean up obsolete exploration/QA docs, add audit documentation

Co-Authored-By: Paperclip <noreply@paperclip.ing>

prisma/prisma.config.ts

@@ -1,16 +1,16 @@
 import path from 'node:path';
 import { defineConfig } from 'prisma/config';
 
+// Use DATABASE_URL_DIRECT (bypasses PgBouncer) for migrations/introspection
+// when available; fall back to DATABASE_URL for local dev without PgBouncer.
+const databaseUrl =
+  process.env.DATABASE_URL_DIRECT || process.env.DATABASE_URL!;
+
 export default defineConfig({
   earlyAccess: true,
   schema: path.join(__dirname, 'schema.prisma'),
-  migrate: {
-    async development() {
-      // Use DATABASE_URL_DIRECT (bypasses PgBouncer) for migrations/introspection
-      // when available; fall back to DATABASE_URL for local dev without PgBouncer.
-      return {
-        url: process.env.DATABASE_URL_DIRECT || process.env.DATABASE_URL!,
-      };
-    },
+  // Prisma 7 requires datasource.url for db push, migrate deploy, etc.
+  datasource: {
+    url: databaseUrl,
   },
 });