test(e2e): add coverage for agent profile, KYC, payment callbacks, media upload, and listing moderation

Fills coverage gaps for untested API endpoints:
- GET /auth/profile/agent (auth + unauth)
- PATCH /auth/kyc (admin-only guard tests)
- POST /payments/callback/:provider (VNPay, MoMo, ZaloPay webhooks)
- POST /listings/:id/media (multipart upload validation)
- PATCH /listings/:id/moderate (admin-only moderation)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

e2e/api/auth-agent-profile.spec.ts

@@ -0,0 +1,26 @@
+import { test, expect } from '../fixtures';
+
+test.describe('GET /auth/profile/agent', () => {
+  test('returns agent profile or null for authenticated user', async ({ authedRequest }) => {
+    const res = await authedRequest.get('/auth/profile/agent');
+
+    expect(res.status()).toBe(200);
+    const body = await res.json();
+    // Regular user may not have an agent — null is valid
+    expect([null, expect.objectContaining({})]).toContainEqual(body);
+  });
+
+  test('rejects unauthenticated requests', async ({ request }) => {
+    const res = await request.get('/auth/profile/agent');
+
+    expect(res.status()).toBe(401);
+  });
+
+  test('rejects requests with invalid token', async ({ request }) => {
+    const res = await request.get('/auth/profile/agent', {
+      headers: { Authorization: 'Bearer invalid.jwt.token' },
+    });
+
+    expect(res.status()).toBe(401);
+  });
+});