fix: resolve E2E test failures and API runtime issues for Docker dev environment

- Fix DI issues: circular MCP module dependency, EventBus type import,
  SearchModule provider, CacheService metric counters placement
- Fix Express 5 readonly req.query in SanitizeInputMiddleware
- Fix Typesense client lazy initialization (getter instead of constructor)
- Fix MinIO bucket init error handling (non-fatal on 403)
- Fix missing class-validator decorators on bigint DTO fields (priceVND, amountVND)
- Fix subscription plan 404 (was returning 500 for invalid tier)
- Disable CSRF and raise rate limits in test environment
- Update E2E tests to match actual API response shapes
- Update CI workflow with Redis, Typesense, MinIO services and env vars

All 101 API E2E tests now pass against Docker dev environment.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

e2e/api/payments.spec.ts

@@ -14,9 +14,9 @@ test.describe('Payments API', () => {
         data: {
           provider: 'VNPAY',
           type: 'LISTING_FEE',
-          amountVND: 500000,
+          amountVND: '500000',
           description: 'E2E test listing fee payment',
-          returnUrl: 'http://localhost:3000/payments/callback',
+          returnUrl: 'https://example.com/payments/callback',
         },
         headers: { Authorization: `Bearer ${accessToken}` },
       });
@@ -29,7 +29,7 @@ test.describe('Payments API', () => {
 
       expect(res.status()).toBe(201);
       const body = await res.json();
-      expect(body).toHaveProperty('id');
+      expect(body).toHaveProperty('paymentId');
       expect(body).toHaveProperty('paymentUrl');
     });
 
@@ -48,9 +48,9 @@ test.describe('Payments API', () => {
         data: {
           provider: 'INVALID_PROVIDER',
           type: 'LISTING_FEE',
-          amountVND: 500000,
+          amountVND: '500000',
           description: 'Invalid provider test',
-          returnUrl: 'http://localhost:3000/callback',
+          returnUrl: 'https://example.com/callback',
         },
         headers: { Authorization: `Bearer ${accessToken}` },
       });
@@ -64,9 +64,9 @@ test.describe('Payments API', () => {
         data: {
           provider: 'VNPAY',
           type: 'INVALID_TYPE',
-          amountVND: 500000,
+          amountVND: '500000',
           description: 'Invalid type test',
-          returnUrl: 'http://localhost:3000/callback',
+          returnUrl: 'https://example.com/callback',
         },
         headers: { Authorization: `Bearer ${accessToken}` },
       });
@@ -80,9 +80,9 @@ test.describe('Payments API', () => {
         data: {
           provider: 'VNPAY',
           type: 'LISTING_FEE',
-          amountVND: 500000,
+          amountVND: '500000',
           description: 'Unauth test',
-          returnUrl: 'http://localhost:3000/callback',
+          returnUrl: 'https://example.com/callback',
         },
       });
 
@@ -98,8 +98,8 @@ test.describe('Payments API', () => {
 
       expect(res.status()).toBe(200);
       const body = await res.json();
-      expect(body).toHaveProperty('data');
-      expect(Array.isArray(body.data)).toBeTruthy();
+      expect(body).toHaveProperty('items');
+      expect(Array.isArray(body.items)).toBeTruthy();
     });
 
     test('supports pagination params', async ({ request }) => {
@@ -110,7 +110,7 @@ test.describe('Payments API', () => {
 
       expect(res.status()).toBe(200);
       const body = await res.json();
-      expect(body.data.length).toBeLessThanOrEqual(5);
+      expect(body.items.length).toBeLessThanOrEqual(5);
     });
 
     test('rejects unauthenticated transaction list', async ({ request }) => {