[CLAUDE] Domain+App+Api+Tests+FE-Admin+FE-User: S34 Plan 3 Phase 1.5 batch 4 item

Phase 1.5 backlog G-H1 EmployeeProfile hardening batch (Items 6+2+1+4 of 6).

Item 6 — menuKeys FE drift sync × 2 app:
- fe-admin add: Catalogs + 4 Catalog leaves + Workflows + Budgets + Bg_List/Create/Pending (10 key)
- fe-user add: Budgets + Bg_List/Create/Pending + ApprovalWorkflowsV2 + 2 AwV2 leaf + MenuVisibility + Workflows (8 key)
- Cả 2 file giờ identical mirror BE MenuKeys.cs (28 key cumulative)

Item 2 — UpdateEmployeeProfileCommand bool→bool? safe partial update:
- 3 field IsCommunistParty/IsYouthUnion/IsTradeUnion → bool?
- Handler: HasValue check, null = giữ giá trị cũ (Reviewer minor #(b) S33 fixed)
- FE không bắt buộc gửi 3 field every PUT — tránh accidental reset

Item 1 — EmployeesController per-action policy (gotcha #44 mitigation):
- Class-level [Authorize(Policy = "Hrm_HoSo.Read")] — non-admin thiếu Read → 403
- POST [Authorize(Policy = "Hrm_HoSo.Create")]
- PUT  [Authorize(Policy = "Hrm_HoSo.Update")]
- DELETE [Authorize(Policy = "Hrm_HoSo.Delete")]

Item 4 — Test bundle Phase 1.5 (+10 [Fact], baseline 120 → 130/130 PASS):
- EmployeeCodeGeneratorTests (3 [Fact]) — atomic SERIALIZABLE NV/YYYY/NNNN
  + first call + sequential increment + year boundary preserve old year
- CreateEmployeeProfileCommandTests (4 [Fact]) — Create handler edge case
  + first profile + duplicate UserId Conflict + soft-deleted Conflict-restore
  + UserNotFound NotFoundException
- ListEmployeesQueryTests (3 [Fact]) — filter + paging logic
  + status filter + departmentId filter + search by EmployeeCode partial

Implementer Case 3 test gen caught spec mismatch (allow new after soft-delete
vs throws Conflict-restore) — chose CODE source of truth + renamed test
documenting discriminator message branch. Em main verify behavior correct
(admin UX khôi phục thay vì tạo mới — explicit flow defer Phase 1.5+).

Verify:
- dotnet build PASS (2 warn DocxRenderer baseline, 0 error)
- dotnet test 130/130 PASS (58 Domain + 72 Infra = +10)
- 4 endpoint /api/employees policy wired (gotcha #44 active mitigation)
- 4 MEMORY agent updated post-spawn (CICD Run #238 + Implementer test bundle)

Deferred Phase 1.5 next batch:
- Item 3 Satellite CRUD endpoints (WorkHistory/Education/FamilyRelation/Skill/
  Document) + FE inline edit forms — heavy ~2-3h
- Item 5 UAT smoke non-admin role verify silent 403 catch — defer post-deploy

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fe-admin/src/lib/menuKeys.ts

@@ -5,6 +5,12 @@ export const MenuKeys = {
   Suppliers: 'Suppliers',
   Projects: 'Projects',
   Departments: 'Departments',
+  // 4 master catalogs cho Details add form autocomplete (Plan CA S29 — UI sang fe-user)
+  Catalogs: 'Catalogs',
+  CatalogUnits: 'CatalogUnits',
+  CatalogMaterials: 'CatalogMaterials',
+  CatalogServices: 'CatalogServices',
+  CatalogWorkItems: 'CatalogWorkItems',
   Contracts: 'Contracts',
   Forms: 'Forms',
   Reports: 'Reports',
@@ -13,12 +19,18 @@ export const MenuKeys = {
   Roles: 'Roles',
   Permissions: 'Permissions',
   MenuVisibility: 'MenuVisibility',
+  Workflows: 'Workflows',
   PurchaseEvaluations: 'PurchaseEvaluations',
   PeWorkflows: 'PeWorkflows',
   // Quy trình duyệt MỚI (Mig 22 — Session 17, 2026-05-08)
   ApprovalWorkflowsV2: 'ApprovalWorkflowsV2',
   AwV2_DuyetNcc: 'AwV2_DuyetNcc',
   AwV2_DuyetNccPhuongAn: 'AwV2_DuyetNccPhuongAn',
+  // Module Ngân sách (Phase 7)
+  Budgets: 'Budgets',
+  Bg_List: 'Bg_List',
+  Bg_Create: 'Bg_Create',
+  Bg_Pending: 'Bg_Pending',
   // Module Hồ sơ Nhân sự (Mig 34 — Phase 10.1 G-H1 Session 33, 2026-05-26)
   Hrm: 'Hrm',
   HrmHoSo: 'Hrm_HoSo',