feat(auth): add DEVELOPER + PARK_OPERATOR roles with owner scoping (B2B accounts)

Two new B2B roles for CĐT (project developers) and KCN operators, provisioned by
admin. Each account owns a subset of ProjectDevelopment / IndustrialPark records
and can CRUD them from the dashboard; admin retains full access.

Phase 1 — Schema
- Extend UserRole enum with DEVELOPER + PARK_OPERATOR (before ADMIN)
- ProjectDevelopment.ownerId FK (User, ON DELETE SET NULL) + index
- IndustrialPark.ownerId FK + index
- Migration 20260420030000

Phase 2a — Backend authorization
- CreateProjectCommand + CreateIndustrialParkCommand accept ownerId; controllers
  auto-set it to the caller's user id when role=DEVELOPER / PARK_OPERATOR
- Update + Delete commands gain (requesterUserId, requesterRole) and enforce
  ADMIN-or-owner via ForbiddenException; reassigning ownerId is admin-only
- Search params gain optional ownerId filter wired through Prisma repos
- New endpoints: GET /projects/mine/list, GET /industrial/parks/mine/list
- user-rate-limit guard: add DEVELOPER + PARK_OPERATOR entries (300/window)

Phase 2b — Admin provision
- ProvisionDeveloperCommand/Handler: create user (role=DEVELOPER), pre-validate
  target projects have no existing owner, batch-assign ownerId
- ProvisionParkOperatorCommand/Handler: same for PARK_OPERATOR + IndustrialPark
- POST /admin/accounts/developers, POST /admin/accounts/park-operators (admin-only)
- DTOs with phone/password/fullName/email + optional {project,park}Ids[]

Phase 2c — Project stats for developer dashboard
- GetProjectStatsQuery + handler: aggregates linkedListingCount, activeListingCount,
  totalInquiries, unreadInquiries, savedByUsers via Property → Listing → Inquiry chain
- GET /projects/:id/stats — admin sees all, DEVELOPER only their own (403 otherwise)

Phase 3 — Frontend
- Dashboard layout role-aware: DEVELOPER sees "Dự án của tôi" + CRM + Profile (hides
  listings/analytics/subscription); PARK_OPERATOR sees "KCN của tôi" equivalent
- /projects dashboard page switches to duAnApi.searchMine() when role=DEVELOPER
- /industrial-parks page switches to industrialApi.searchMine() when role=PARK_OPERATOR
- Admin nav gains "Tài khoản CĐT" + "Tài khoản KCN" entries
- New pages /admin/accounts/developers + /admin/accounts/park-operators with
  checkbox-based multi-select for linking entities
- adminApi.provisionDeveloper + provisionParkOperator + types
- duAnApi.searchMine + getStats; industrialApi.searchMine
- Login demo accounts list includes CĐT Vingroup + KCN VSIP

Phase 4 — Seed (prisma/seed-b2b-accounts.ts)
- DEVELOPER "CĐT Vingroup" (+84912000001) owns 4 projects
- DEVELOPER "CĐT Masterise Homes" (+84912000003) owns 2 projects
- PARK_OPERATOR "Vận hành KCN VSIP" (+84912000002) owns 2 seeded KCN
- Password Velik@2026 for all

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/modules/industrial/presentation/controllers/industrial-parks.controller.ts

@@ -2,7 +2,8 @@ import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseGuards } f
 import { CommandBus, QueryBus } from '@nestjs/cqrs';
 import { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { UserRole } from '@prisma/client';
-import { JwtAuthGuard, Roles, RolesGuard } from '@modules/auth';
+import { CurrentUser, JwtAuthGuard, Roles, RolesGuard } from '@modules/auth';
+import type { JwtPayload } from '@modules/auth';
 import { NotFoundException } from '@modules/shared';
 import { AnalyzeIndustrialLocationQuery } from '../../application/queries/analyze-industrial-location/analyze-industrial-location.query';
 import { CreateIndustrialParkCommand } from '../../application/commands/create-industrial-park/create-industrial-park.command';
@@ -50,6 +51,39 @@ export class IndustrialParksController {
     );
   }
 
+  // ── Park Operator endpoints ───────────────────────────────────────
+
+  @ApiOperation({
+    summary: 'KCN của tôi (Park Operator)',
+    description: 'Danh sách KCN mà user hiện tại vận hành. ADMIN dùng endpoint này để xem KCN đã được gán cho mình.',
+  })
+  @ApiResponse({ status: 200, description: 'Danh sách KCN đã lọc theo owner' })
+  @ApiResponse({ status: 401, description: 'Chưa xác thực' })
+  @ApiResponse({ status: 403, description: 'Không có quyền' })
+  @ApiBearerAuth('JWT')
+  @UseGuards(JwtAuthGuard, RolesGuard)
+  @Roles(UserRole.PARK_OPERATOR, UserRole.ADMIN)
+  @Get('parks/mine/list')
+  async listMyParks(
+    @CurrentUser() user: JwtPayload,
+    @Query() dto: SearchIndustrialParksDto,
+  ) {
+    return this.queryBus.execute(
+      new ListIndustrialParksQuery(
+        dto.q,
+        dto.province,
+        dto.region,
+        dto.status,
+        dto.minAreaHa,
+        dto.maxRentUsdM2,
+        dto.targetIndustry,
+        dto.page ?? 1,
+        dto.limit ?? 20,
+        user.sub,
+      ),
+    );
+  }
+
   @ApiOperation({ summary: 'Chi tiết KCN', description: 'Xem chi tiết KCN theo slug hoặc ID' })
   @ApiResponse({ status: 200, description: 'Thông tin chi tiết KCN' })
   @ApiResponse({ status: 404, description: 'Không tìm thấy KCN' })
@@ -124,9 +158,14 @@ export class IndustrialParksController {
   @ApiResponse({ status: 403, description: 'Không có quyền' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.PARK_OPERATOR)
   @Post('parks')
-  async createPark(@Body() dto: CreateIndustrialParkDto) {
+  async createPark(
+    @CurrentUser() user: JwtPayload,
+    @Body() dto: CreateIndustrialParkDto,
+  ) {
+    // PARK_OPERATOR callers own what they create; admin may leave unassigned.
+    const ownerId = user.role === UserRole.PARK_OPERATOR ? user.sub : null;
     return this.commandBus.execute(
       new CreateIndustrialParkCommand(
         dto.name,
@@ -157,6 +196,7 @@ export class IndustrialParksController {
         dto.targetIndustries,
         dto.description ?? null,
         dto.descriptionEn ?? null,
+        ownerId,
       ),
     );
   }
@@ -168,12 +208,18 @@ export class IndustrialParksController {
   @ApiResponse({ status: 404, description: 'Không tìm thấy tài nguyên' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.PARK_OPERATOR)
   @Patch('parks/:id')
-  async updatePark(@Param('id') id: string, @Body() dto: UpdateIndustrialParkDto) {
+  async updatePark(
+    @CurrentUser() user: JwtPayload,
+    @Param('id') id: string,
+    @Body() dto: UpdateIndustrialParkDto,
+  ) {
     return this.commandBus.execute(
       new UpdateIndustrialParkCommand(
         id,
+        user.sub,
+        user.role as UserRole,
         dto.name,
         dto.nameEn,
         dto.developer,
@@ -193,6 +239,7 @@ export class IndustrialParksController {
         dto.description,
         dto.descriptionEn,
         dto.isVerified,
+        dto.ownerId,
       ),
     );
   }
@@ -204,10 +251,15 @@ export class IndustrialParksController {
   @ApiResponse({ status: 404, description: 'Không tìm thấy tài nguyên' })
   @ApiBearerAuth('JWT')
   @UseGuards(JwtAuthGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
+  @Roles(UserRole.ADMIN, UserRole.PARK_OPERATOR)
   @Delete('parks/:id')
-  async deletePark(@Param('id') id: string): Promise<{ success: true }> {
-    await this.commandBus.execute(new DeleteIndustrialParkCommand(id));
+  async deletePark(
+    @CurrentUser() user: JwtPayload,
+    @Param('id') id: string,
+  ): Promise<{ success: true }> {
+    await this.commandBus.execute(
+      new DeleteIndustrialParkCommand(id, user.sub, user.role as UserRole),
+    );
     return { success: true };
   }
 }