[CLAUDE] Phase1.2: CRUD Master + Permission Matrix + FE admin pages

Backend:
- Domain/Master: Supplier (+ SupplierType 5 loai), Project, Department (AuditableEntity)
- Domain/Identity: MenuItem, Permission, MenuKeys const (12 menu)
- EF Configurations voi unique Code + query filter IsDeleted
- DbSets + IApplicationDbContext interface update
- Application: PagedResult + PagedRequest generic
- Application/Master CQRS CRUD 3 entity (Create/Update/Delete/Get/List voi paging search sort)
- Application/Permissions: GetMyMenuTree (union OR role, filter tree), ListMenuItems, ListPermissionsByRole, UpsertPermission (guard admin khong tu giam quyen), ListRoles
- Api/Authorization: MenuPermissionRequirement + Handler (Admin bypass, query DB)
- Program.cs: register 48 policy {menu}.{action} tu MenuKeys x Actions
- Api/Controllers: Suppliers, Projects, Departments, Menus, Roles, Permissions
- DbInitializer: seed 12 menu + admin full CRUD permissions
- Migration AddMasterData + AddPermissions

Frontend (fe-admin):
- Types: menuKeys.ts const, menu.ts (MenuNode/Role/Permission), master.ts (Supplier/Project/Department + SupplierType const-object)
- AuthContext: load menu from /menus/me, cache localStorage, refreshMenu()
- usePermission hook + PermissionGuard component (wrap button)
- UI kit them: Dialog (modal overlay), Textarea, Select
- Generic: DataTable (column config, sortable, loading, empty) + Pagination
- PageHeader component
- apiError helper extract message tu ProblemDetails
- Layout rewrite: render menu dong tu AuthContext.menu (MenuGroup collapsible + NavLink + lucide icon map)
- Pages: master/Suppliers, master/Projects, master/Departments (CRUD + search + sort + paging + Dialog form)
- Page system/Permissions: ma tran Role x MenuKey x CRUD checkbox (tick tu dong PUT upsert)
- App.tsx them 4 route moi

Bug fix:
- MenuPermissionHandler: EF expression tree khong support switch expression -> tach switch ra ngoai AnyAsync
- TS erasableSyntaxOnly khong cho enum -> SupplierType const-object pattern (typeof[keyof])

E2E verified via Vite proxy:
- GET /menus/me -> 6 root + 6 child nodes (12 menus)
- GET /roles -> 12 roles
- POST/GET/PUT/DELETE /suppliers -> full CRUD, soft delete OK
- tsc -b fe-admin pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Authorization/MenuPermissionHandler.cs

@@ -0,0 +1,54 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.EntityFrameworkCore;
+using SolutionErp.Application.Common.Interfaces;
+using SolutionErp.Domain.Identity;
+
+namespace SolutionErp.Api.Authorization;
+
+public class MenuPermissionHandler(
+    IApplicationDbContext db,
+    UserManager<User> userManager,
+    RoleManager<Role> roleManager) : AuthorizationHandler<MenuPermissionRequirement>
+{
+    protected override async Task HandleRequirementAsync(
+        AuthorizationHandlerContext context, MenuPermissionRequirement req)
+    {
+        var sub = context.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value
+               ?? context.User.FindFirst("sub")?.Value;
+        if (!Guid.TryParse(sub, out var userId)) return;
+
+        var user = await userManager.FindByIdAsync(userId.ToString());
+        if (user is null || !user.IsActive) return;
+
+        var roleNames = await userManager.GetRolesAsync(user);
+
+        // Admin bypass
+        if (roleNames.Contains(AppRoles.Admin))
+        {
+            context.Succeed(req);
+            return;
+        }
+
+        var roleIds = new List<Guid>();
+        foreach (var name in roleNames)
+        {
+            var r = await roleManager.FindByNameAsync(name);
+            if (r is not null) roleIds.Add(r.Id);
+        }
+
+        var baseQuery = db.Permissions
+            .Where(p => roleIds.Contains(p.RoleId) && p.MenuKey == req.MenuKey);
+
+        var hasPermission = req.Action switch
+        {
+            "Read" => await baseQuery.AnyAsync(p => p.CanRead),
+            "Create" => await baseQuery.AnyAsync(p => p.CanCreate),
+            "Update" => await baseQuery.AnyAsync(p => p.CanUpdate),
+            "Delete" => await baseQuery.AnyAsync(p => p.CanDelete),
+            _ => false,
+        };
+
+        if (hasPermission) context.Succeed(req);
+    }
+}

src/Backend/SolutionErp.Api/Authorization/MenuPermissionRequirement.cs

@@ -0,0 +1,9 @@
+using Microsoft.AspNetCore.Authorization;
+
+namespace SolutionErp.Api.Authorization;
+
+public class MenuPermissionRequirement(string menuKey, string action) : IAuthorizationRequirement
+{
+    public string MenuKey { get; } = menuKey;
+    public string Action { get; } = action;  // "Read" | "Create" | "Update" | "Delete"
+}