Fills coverage gaps for untested API endpoints: - GET /auth/profile/agent (auth + unauth) - PATCH /auth/kyc (admin-only guard tests) - POST /payments/callback/:provider (VNPay, MoMo, ZaloPay webhooks) - POST /listings/:id/media (multipart upload validation) - PATCH /listings/:id/moderate (admin-only moderation) Co-Authored-By: Paperclip <noreply@paperclip.ing>