feat: add P0/P1/P2 features + Swagger enrichment for MVP completeness

Closes four gaps the Swagger audit flagged as blocking a full MVP demo,
plus a general documentation pass.

P0 — Forgot/Reset password (auth)
- POST /auth/forgot-password (anti-enumeration: always 200)
- POST /auth/reset-password
- Reuses the Redis-OTP pattern from email/phone change; new key prefix
  auth:password_reset_otp with 15-min TTL.
- Emits PasswordResetRequestedEvent; new listener in notifications
  dispatches the existing password.reset email template (otp +
  expiryMinutes variables already in template.service.ts).
- UserEntity gains changePassword(HashedPassword) domain method; reset
  also revokes all refresh tokens for the user.

P0 — Favorites module
- New SavedListing Prisma model (unique(userId, listingId)) with User
  and Listing back-relations; schema pushed via db push since the
  remote DB was out of sync with migration history.
- New apps/api/src/modules/favorites/ module following the reviews
  module's shape (DDD/CQRS: domain repo + Prisma impl + 2 commands
  + 2 queries + controller).
- POST /favorites/:listingId, DELETE /favorites/:listingId,
  GET /favorites (paginated), GET /favorites/:listingId/check. All
  guarded by JwtAuthGuard.
- FavoritesModule wired into AppModule.

P1 — Resend OTP (auth)
- POST /auth/resend-otp for EMAIL_CHANGE | PHONE_CHANGE. Reads the
  pending OTP payload out of Redis and re-emits the original event
  without minting a new code, so TTL semantics stay intact. Password
  reset resend is done by re-POSTing /auth/forgot-password and is
  deliberately not in this enum.

P1 — Agent self-upgrade (agents)
- POST /agents/me/upgrade lets a BUYER/SELLER convert to AGENT. Creates
  an Agent row (isVerified=false) and flips User.role in one
  $transaction. Rejects if already AGENT/ADMIN or if an Agent row
  already exists.

P2 — Swagger enrichment
- @ApiConsumes('multipart/form-data') + body schema on listings media
  upload.
- GET /subscriptions/quota/:metric now enumerates the real metric
  values from METRIC_TO_PLAN_FIELD.
- POST /avm/batch and /analytics/valuation/batch document the max=50
  batch size from their DTO's @ArrayMaxSize.
- GET /admin/dashboard gains a realistic response example schema.
- Admin-gated endpoints in projects/transfer/industrial gain concrete
  400/401/403/404 responses.

Swagger endpoint count: 170 → 178. Typecheck clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/modules/analytics/presentation/controllers/analytics.controller.ts

@@ -8,7 +8,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { QueryBus } from '@nestjs/cqrs';
-import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth, ApiParam } from '@nestjs/swagger';
+import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth, ApiBody, ApiParam } from '@nestjs/swagger';
 import { JwtAuthGuard } from '@modules/auth';
 import { EndpointRateLimit, EndpointRateLimitGuard } from '@modules/shared';
 import { RequireQuota, QuotaGuard } from '@modules/subscriptions';
@@ -118,8 +118,25 @@ export class AnalyticsController {
   @RequireQuota('analytics_queries')
   @Post('valuation/batch')
   @ApiOperation({ summary: 'Batch valuation for multiple properties (max 50)' })
+  @ApiBody({
+    schema: {
+      type: 'object',
+      properties: {
+        propertyIds: {
+          type: 'array',
+          minItems: 1,
+          maxItems: 50,
+          items: { type: 'string' },
+          example: ['prop-1', 'prop-2'],
+          description: 'Array of property IDs to valuate (1-50)',
+        },
+      },
+      required: ['propertyIds'],
+    },
+  })
   @ApiResponse({ status: 200, description: 'Batch valuation results retrieved' })
   @ApiResponse({ status: 400, description: 'Invalid parameters' })
+  @ApiResponse({ status: 401, description: 'Chưa xác thực' })
   @ApiResponse({ status: 403, description: 'Quota exceeded' })
   @ApiResponse({ status: 429, description: 'Rate limit exceeded' })
   async batchValuation(@Body() dto: BatchValuationDto): Promise<BatchValuationQueryDto> {

apps/api/src/modules/analytics/presentation/controllers/avm.controller.ts

@@ -8,7 +8,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { QueryBus } from '@nestjs/cqrs';
-import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth, ApiParam, ApiQuery } from '@nestjs/swagger';
+import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth, ApiBody, ApiParam, ApiQuery } from '@nestjs/swagger';
 import { JwtAuthGuard } from '@modules/auth';
 import { EndpointRateLimit, EndpointRateLimitGuard } from '@modules/shared';
 import { RequireQuota, QuotaGuard } from '@modules/subscriptions';
@@ -38,8 +38,25 @@ export class AvmController {
   @RequireQuota('analytics_queries')
   @Post('batch')
   @ApiOperation({ summary: 'Batch valuation for multiple properties (max 50)' })
+  @ApiBody({
+    schema: {
+      type: 'object',
+      properties: {
+        propertyIds: {
+          type: 'array',
+          minItems: 1,
+          maxItems: 50,
+          items: { type: 'string' },
+          example: ['prop-1', 'prop-2'],
+          description: 'Array of property IDs to valuate (1-50)',
+        },
+      },
+      required: ['propertyIds'],
+    },
+  })
   @ApiResponse({ status: 200, description: 'Batch valuation results' })
   @ApiResponse({ status: 400, description: 'Invalid parameters' })
+  @ApiResponse({ status: 401, description: 'Chưa xác thực' })
   @ApiResponse({ status: 403, description: 'Quota exceeded' })
   @ApiResponse({ status: 429, description: 'Rate limit exceeded — max 10 requests per 60s' })
   async batchValuation(@Body() dto: BatchValuationDto): Promise<BatchValuationResultDto> {