feat(auth): add DEVELOPER + PARK_OPERATOR roles with owner scoping (B2B accounts)

Two new B2B roles for CĐT (project developers) and KCN operators, provisioned by
admin. Each account owns a subset of ProjectDevelopment / IndustrialPark records
and can CRUD them from the dashboard; admin retains full access.

Phase 1 — Schema
- Extend UserRole enum with DEVELOPER + PARK_OPERATOR (before ADMIN)
- ProjectDevelopment.ownerId FK (User, ON DELETE SET NULL) + index
- IndustrialPark.ownerId FK + index
- Migration 20260420030000

Phase 2a — Backend authorization
- CreateProjectCommand + CreateIndustrialParkCommand accept ownerId; controllers
  auto-set it to the caller's user id when role=DEVELOPER / PARK_OPERATOR
- Update + Delete commands gain (requesterUserId, requesterRole) and enforce
  ADMIN-or-owner via ForbiddenException; reassigning ownerId is admin-only
- Search params gain optional ownerId filter wired through Prisma repos
- New endpoints: GET /projects/mine/list, GET /industrial/parks/mine/list
- user-rate-limit guard: add DEVELOPER + PARK_OPERATOR entries (300/window)

Phase 2b — Admin provision
- ProvisionDeveloperCommand/Handler: create user (role=DEVELOPER), pre-validate
  target projects have no existing owner, batch-assign ownerId
- ProvisionParkOperatorCommand/Handler: same for PARK_OPERATOR + IndustrialPark
- POST /admin/accounts/developers, POST /admin/accounts/park-operators (admin-only)
- DTOs with phone/password/fullName/email + optional {project,park}Ids[]

Phase 2c — Project stats for developer dashboard
- GetProjectStatsQuery + handler: aggregates linkedListingCount, activeListingCount,
  totalInquiries, unreadInquiries, savedByUsers via Property → Listing → Inquiry chain
- GET /projects/:id/stats — admin sees all, DEVELOPER only their own (403 otherwise)

Phase 3 — Frontend
- Dashboard layout role-aware: DEVELOPER sees "Dự án của tôi" + CRM + Profile (hides
  listings/analytics/subscription); PARK_OPERATOR sees "KCN của tôi" equivalent
- /projects dashboard page switches to duAnApi.searchMine() when role=DEVELOPER
- /industrial-parks page switches to industrialApi.searchMine() when role=PARK_OPERATOR
- Admin nav gains "Tài khoản CĐT" + "Tài khoản KCN" entries
- New pages /admin/accounts/developers + /admin/accounts/park-operators with
  checkbox-based multi-select for linking entities
- adminApi.provisionDeveloper + provisionParkOperator + types
- duAnApi.searchMine + getStats; industrialApi.searchMine
- Login demo accounts list includes CĐT Vingroup + KCN VSIP

Phase 4 — Seed (prisma/seed-b2b-accounts.ts)
- DEVELOPER "CĐT Vingroup" (+84912000001) owns 4 projects
- DEVELOPER "CĐT Masterise Homes" (+84912000003) owns 2 projects
- PARK_OPERATOR "Vận hành KCN VSIP" (+84912000002) owns 2 seeded KCN
- Password Velik@2026 for all

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

prisma/seed-b2b-accounts.ts

@@ -0,0 +1,145 @@
+/**
+ * One-off seed script: provision 2 B2B demo accounts (DEVELOPER + PARK_OPERATOR)
+ * and backfill ownership for a subset of existing projects / industrial parks.
+ * Safe to re-run — uses upsert semantics.
+ */
+import { PrismaPg } from '@prisma/adapter-pg';
+import { PrismaClient } from '@prisma/client';
+import bcrypt from 'bcrypt';
+import { createHash } from 'node:crypto';
+import pg from 'pg';
+
+const pool = new pg.Pool({ connectionString: process.env['DATABASE_URL'] });
+const adapter = new PrismaPg(pool);
+const prisma = new PrismaClient({ adapter });
+
+const DEMO_PASSWORD = 'Velik@2026';
+
+// Matches how RegisterUserHandler (HashedPassword.fromPlain) bcrypts, cost 12.
+async function hashPassword(raw: string): Promise<string> {
+  return bcrypt.hash(raw, 12);
+}
+
+function hash(value: string): string {
+  return createHash('sha256').update(value.toLowerCase().trim()).digest('hex');
+}
+
+async function main() {
+  const passwordHash = await hashPassword(DEMO_PASSWORD);
+
+  // ── 1. DEVELOPER: CĐT Vingroup ──
+  const developerPhone = '+84912000001';
+  const developerEmail = 'cdt-vingroup@goodgo.vn';
+  const developer = await prisma.user.upsert({
+    where: { phoneHash: hash(developerPhone) },
+    update: { role: 'DEVELOPER', isActive: true },
+    create: {
+      id: 'seed-developer-001',
+      phone: developerPhone,
+      phoneHash: hash(developerPhone),
+      email: developerEmail,
+      emailHash: hash(developerEmail),
+      passwordHash,
+      fullName: 'CĐT Vingroup',
+      role: 'DEVELOPER',
+      kycStatus: 'VERIFIED',
+      avatarUrl:
+        'https://ui-avatars.com/api/?name=CDT+Vingroup&background=7c3aed&color=fff',
+      isActive: true,
+    },
+  });
+
+  // Link Vingroup-led projects.
+  const vingroupProjectIds = [
+    'seed-project-001', // Vinhomes Grand Park
+    'seed-project-005', // Vinhomes Central Park
+    'seed-project-007', // Vinhomes Ocean Park
+    'seed-project-010', // Vinhomes Smart City
+  ];
+  const vingroupRes = await prisma.projectDevelopment.updateMany({
+    where: { id: { in: vingroupProjectIds } },
+    data: { ownerId: developer.id },
+  });
+
+  // ── 2. DEVELOPER: CĐT Masterise Homes ──
+  const devMasterPhone = '+84912000003';
+  const devMasterEmail = 'cdt-masterise@goodgo.vn';
+  const devMaster = await prisma.user.upsert({
+    where: { phoneHash: hash(devMasterPhone) },
+    update: { role: 'DEVELOPER', isActive: true },
+    create: {
+      id: 'seed-developer-002',
+      phone: devMasterPhone,
+      phoneHash: hash(devMasterPhone),
+      email: devMasterEmail,
+      emailHash: hash(devMasterEmail),
+      passwordHash,
+      fullName: 'CĐT Masterise Homes',
+      role: 'DEVELOPER',
+      kycStatus: 'VERIFIED',
+      avatarUrl:
+        'https://ui-avatars.com/api/?name=Masterise&background=6366f1&color=fff',
+      isActive: true,
+    },
+  });
+
+  const masterProjectIds = ['seed-project-002', 'seed-project-008']; // Masteri Thảo Điền + The Global City
+  const masterRes = await prisma.projectDevelopment.updateMany({
+    where: { id: { in: masterProjectIds } },
+    data: { ownerId: devMaster.id },
+  });
+
+  // ── 3. PARK_OPERATOR: KCN VSIP ──
+  const parkPhone = '+84912000002';
+  const parkEmail = 'kcn-vsip@goodgo.vn';
+  const parkOp = await prisma.user.upsert({
+    where: { phoneHash: hash(parkPhone) },
+    update: { role: 'PARK_OPERATOR', isActive: true },
+    create: {
+      id: 'seed-park-operator-001',
+      phone: parkPhone,
+      phoneHash: hash(parkPhone),
+      email: parkEmail,
+      emailHash: hash(parkEmail),
+      passwordHash,
+      fullName: 'Vận hành KCN VSIP',
+      role: 'PARK_OPERATOR',
+      kycStatus: 'VERIFIED',
+      avatarUrl:
+        'https://ui-avatars.com/api/?name=VSIP&background=0891b2&color=fff',
+      isActive: true,
+    },
+  });
+
+  // Link any KCN with "vsip" in the slug or name.
+  const parks = await prisma.industrialPark.findMany({
+    where: {
+      OR: [
+        { slug: { contains: 'vsip', mode: 'insensitive' } },
+        { name: { contains: 'VSIP', mode: 'insensitive' } },
+      ],
+    },
+    select: { id: true, name: true, slug: true, ownerId: true },
+  });
+  let parkLinked = 0;
+  if (parks.length > 0) {
+    const res = await prisma.industrialPark.updateMany({
+      where: { id: { in: parks.map((p) => p.id) } },
+      data: { ownerId: parkOp.id },
+    });
+    parkLinked = res.count;
+  }
+
+  console.log('─── B2B seed summary ───');
+  console.log(`DEVELOPER: ${developer.fullName} (${developerPhone}) — linked ${vingroupRes.count} projects`);
+  console.log(`DEVELOPER: ${devMaster.fullName} (${devMasterPhone}) — linked ${masterRes.count} projects`);
+  console.log(`PARK_OPERATOR: ${parkOp.fullName} (${parkPhone}) — linked ${parkLinked} KCN(s)`);
+  console.log('Password for all: ' + DEMO_PASSWORD);
+}
+
+main()
+  .catch((e) => {
+    console.error(e);
+    process.exit(1);
+  })
+  .finally(() => prisma.$disconnect());