feat(auth): implement KYC upload with presigned URLs and multi-step form

Backend:
- GenerateKycUploadUrls command — presigned MinIO URLs (5-min expiry),
  MIME validation (JPEG/PNG/WebP), unique object keys per user
- SubmitKyc command — stores document type, number, and image URLs in
  kycData JSON field, updates kycStatus to PENDING
- POST /auth/kyc/upload-urls and POST /auth/kyc/submit endpoints

Frontend:
- 3-step KYC form: document info → image upload → review
- Direct client-to-MinIO upload via presigned URLs with progress tracking
- Status-aware UI (NONE/PENDING/VERIFIED/REJECTED)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/auth/presentation/controllers/auth.controller.ts

@@ -27,6 +27,8 @@ import { LoginUserCommand } from '../../application/commands/login-user/login-us
 import { type LoginResult } from '../../application/commands/login-user/login-user.handler';
 import { RefreshTokenCommand } from '../../application/commands/refresh-token/refresh-token.command';
 import { RegisterUserCommand } from '../../application/commands/register-user/register-user.command';
+import { GenerateKycUploadUrlsCommand, type KycFileRequest } from '../../application/commands/generate-kyc-upload-urls/generate-kyc-upload-urls.command';
+import { type KycUploadUrlResult } from '../../application/commands/generate-kyc-upload-urls/generate-kyc-upload-urls.handler';
 import { SubmitKycCommand } from '../../application/commands/submit-kyc/submit-kyc.command';
 import { UpdateProfileCommand } from '../../application/commands/update-profile/update-profile.command';
 import { type UpdateProfileResultDto } from '../../application/commands/update-profile/update-profile.handler';
@@ -244,57 +246,56 @@ export class AuthController {
   }
 
   @UseGuards(JwtAuthGuard)
-  @UseInterceptors(
-    FileFieldsInterceptor([
-      { name: 'frontImage', maxCount: 1 },
-      { name: 'backImage', maxCount: 1 },
-      { name: 'selfieImage', maxCount: 1 },
-    ]),
-  )
+  @Post('kyc/upload-urls')
+  @ApiBearerAuth('JWT')
+  @ApiOperation({ summary: 'Generate presigned upload URLs for KYC images' })
+  @ApiResponse({ status: 201, description: 'Presigned URLs generated' })
+  @ApiResponse({ status: 400, description: 'Validation error' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  async generateKycUploadUrls(
+    @Body() body: { files: KycFileRequest[] },
+    @CurrentUser() user: JwtPayload,
+  ): Promise<{ field: string; uploadUrl: string; publicUrl: string; objectKey: string }[]> {
+    return this.commandBus.execute(
+      new GenerateKycUploadUrlsCommand(user.sub, body.files),
+    );
+  }
+
+  @UseGuards(JwtAuthGuard)
   @Post('kyc/submit')
   @ApiBearerAuth('JWT')
-  @ApiConsumes('multipart/form-data')
-  @ApiOperation({ summary: 'Submit KYC documents for verification' })
+  @ApiOperation({ summary: 'Submit KYC documents with presigned image URLs' })
   @ApiResponse({ status: 201, description: 'KYC documents submitted successfully' })
-  @ApiResponse({ status: 400, description: 'Validation error (missing files or invalid format)' })
+  @ApiResponse({ status: 400, description: 'Validation error' })
   @ApiResponse({ status: 401, description: 'Unauthorized' })
-  @ApiResponse({ status: 413, description: 'File too large (max 10MB per image)' })
   async submitKyc(
-    @UploadedFiles()
-    files: {
-      frontImage?: ValidatedFile[];
-      backImage?: ValidatedFile[];
-      selfieImage?: ValidatedFile[];
+    @Body()
+    body: {
+      documentType: string;
+      documentNumber: string;
+      frontImageUrl: string;
+      backImageUrl?: string;
+      selfieUrl?: string;
     },
-    @Body() body: { documentType: string; documentNumber: string },
     @CurrentUser() user: JwtPayload,
   ): Promise<{ message: string }> {
-    const kycImagePipe = new FileValidationPipe({
-      maxSizeBytes: 10 * 1024 * 1024,
-      allowedMimeTypes: ['image/jpeg', 'image/png', 'image/webp'],
-    });
-
-    const frontImage = files.frontImage?.[0];
-    if (!frontImage) {
+    if (!body.frontImageUrl) {
       throw new ValidationException('Vui lòng tải ảnh mặt trước giấy tờ');
     }
-    kycImagePipe.transform(frontImage);
-
-    if (files.backImage?.[0]) {
-      kycImagePipe.transform(files.backImage[0]);
-    }
-    if (files.selfieImage?.[0]) {
-      kycImagePipe.transform(files.selfieImage[0]);
-    }
 
     return this.commandBus.execute(
       new SubmitKycCommand(
         user.sub,
         body.documentType,
         body.documentNumber,
-        frontImage,
-        files.backImage?.[0],
-        files.selfieImage?.[0],
+        undefined,
+        undefined,
+        undefined,
+        {
+          frontImageUrl: body.frontImageUrl,
+          backImageUrl: body.backImageUrl,
+          selfieUrl: body.selfieUrl,
+        },
       ),
     );
   }