fix(web-client-tpos): add permissions and user_id to CreateStaff INSERT

Fix NOT NULL constraint violations in merchant_staff table:
- Add permissions = 0 (default no permissions)
- Add user_id = Guid.Empty (placeholder until linked)
- Verified: CREATE→UPDATE→DELETE all working

.scratchpad/context.md

@@ -1,37 +1,18 @@
-# Scratchpad Context — GoodGo Platform
-> Updated: 2026-03-03 20:10
+# Context — GoodGo Platform
+> Updated: 2026-03-03 20:45
 
-## Trạng thái hệ thống
+## Current Status
+- **P1 + P2 + P3**: ✅ Hoàn thành
+- **Branch**: master
+- **Last Commits**: `8cba902` (Products CRUD) → `15b17f5` (Staff CRUD + Inventory)
 
-### Infrastructure
-- **Docker**: 29 containers running (healthy), Traefik reverse proxy
-- **DB**: PostgreSQL (postgres-local), separate DB per service
-- **Cache**: Redis (redis-local)
-- **Queue**: RabbitMQ (rabbitmq-local)
-- **Storage**: MinIO (minio-local)
+## Recent Changes
+- Products: Full CRUD (Create/Read/Update/Delete) in ShopPage Admin
+- Staff: Full CRUD (Create/Read/Update/Delete=soft) in ShopPage Admin
+- Inventory: Update quantity/reorder level via BFF endpoint
+- Bug fixes: CreateStaff auth, created_at NOT NULL
 
-### Apps
-| App | Type | Port | Status |
-|-----|------|------|--------|
-| web-client-tpos-net | Blazor WASM POS | 3001 | ✅ Running |
-
-## Recent Changes (từ Git log)
-1. `a791830` — **feat**: Add date filter to order history and payment method display
-2. `7562fc1` — **feat**: Add receipt print with thermal 80mm layout
-3. `e74527d` — **feat**: Implement POS order creation via BFF API
-4. `d969f3d` — **feat**: Replace hardcoded POS data with API-driven endpoints
-5. `fe6e14c` — **feat**: Unify POS with inline payment and tabs (path fix)
-
-## Completed Tasks
-- ✅ P1: Order API Create — orders + items persist in DB
-- ✅ P1: Print Receipt — thermal 80mm popup with JSInterop
-- ✅ P2: Dashboard Real Data — hourly chart, popular items, payment breakdown
-- ✅ P2: History Date Filter — today/7d/30d with API reload
-
-## Next Tasks
-- P3: Admin Panel — Products CRUD, Inventory, Staff
-- P4: Frontend Apps — web-client-base-net deploy
-- P5: Infrastructure — Observability, CI/CD, Tests
-
-## Blockers
-- Chưa có
+## Tech Stack
+- Backend: BFF Controller (Dapper + Npgsql → PostgreSQL)
+- Frontend: Blazor WASM (ShopPage.razor + PosDataService.cs)
+- Deploy: Docker Compose (deployments/local)

.scratchpad/plan.md

@@ -1,5 +1,5 @@
 # Task Plan — GoodGo Platform
-> Updated: 2026-03-03 20:10
+> Updated: 2026-03-03 20:45
 
 ## ✅ Completed Tasks
 1. ~~Admin Users & Roles — CRUD, phân quyền~~
@@ -10,14 +10,15 @@
 6. ~~P1: Print Receipt — Thermal 80mm popup~~
 7. ~~P2: Dashboard Real Data — hourly/popular/payment~~
 8. ~~P2: History Date Filter — today/7d/30d~~
+9. ~~P3: Products CRUD — Create/Read/Update/Delete~~
+10. ~~P3: Staff CRUD — Create/Read/Update/Delete (soft-delete)~~
+11. ~~P3: Inventory Update — PUT quantity/reorder level~~
 
 ## Pending Tasks (Ưu tiên cao → thấp)
 
-### 🟡 P3 — Admin Panel (web-client-tpos-net)
-- [ ] **Products CRUD**: Thêm/sửa/xóa products từ Admin
-- [ ] **Inventory management**: Stock alerts, reorder
-- [ ] **Staff management**: Assign staff to shops
+### 🟡 P3 — Admin Panel (còn lại)
 - [ ] **Promotions**: Campaign management UI
+- [ ] **Notifications**: Replace hardcoded bell data
 
 ### 🟢 P4 — Frontend Apps
 - [x] **web-client-tpos-net**: Deployed locally (port 3001) ✅
@@ -30,4 +31,4 @@
 - [ ] **Testing**: Unit + Integration tests coverage
 
 ## Next Task
-> **P3: Products CRUD** — Admin panel thêm/sửa/xóa sản phẩm
+> **Deploy & verify** web-client-tpos-net then continue with Promotions or P4

apps/web-client-tpos-net/src/WebClientTpos.Server/Controllers/BffDataController.cs

@@ -478,9 +478,9 @@ public class BffDataController : ControllerBase
         if (statusId == 0) statusId = 1;
 
         await conn.ExecuteAsync(
-            @"INSERT INTO merchant_staff (id, merchant_id, employee_code, phone, email, role_id, status_id, joined_at, created_at)
-              VALUES (@Id, @MerchantId, @EmployeeCode, @Phone, @Email, @RoleId, @StatusId, NOW(), NOW())",
-            new { Id = id, req.MerchantId, req.EmployeeCode, req.Phone, req.Email, RoleId = roleId, StatusId = statusId });
+            @"INSERT INTO merchant_staff (id, merchant_id, employee_code, phone, email, role_id, status_id, permissions, user_id, joined_at, created_at)
+              VALUES (@Id, @MerchantId, @EmployeeCode, @Phone, @Email, @RoleId, @StatusId, 0, @UserId, NOW(), NOW())",
+            new { Id = id, req.MerchantId, req.EmployeeCode, req.Phone, req.Email, RoleId = roleId, StatusId = statusId, UserId = Guid.Empty });
         return CreatedAtAction(nameof(GetStaff), new { }, new { id });
     }