[CLAUDE] App+Api+FE-User+FE-Admin+Tests: W2 KHKK — CRUD phieu nhap + can cu b.8-9 + FE 3 page x2 app + 12 fix reviewer

- BE mega-file ContractSigningPlanFeatures (Create 4-rao + auto-Lines snapshot per-winner + MaKeHoach @CREATE + UpdateDraft null-safe + Get/List/inbox-precompute-V2/deleted + Dossier + Attachments + Delete allow-list M6 + picker) + Controller 15 action policy per-action 15/15 (KeHoachKyKet.*)
- FE pages/khkk 3 page + types x2 app SHA-pair + 4-place (6 leaf Khkk_* het coming-soon; WfView: user=matrix?type=10 [whitelist +10] / admin=Designer deep-link); root KeHoachKyKet -> /khkk/list
- Reviewer adversarial: 12 finding (3 CRITICAL dut-2-bo FE-BE: route picker + peId body + dossier planId; 2 MAJOR security: detail+download 0 rao -> EnsureCanViewAsync mirror PE S89 nhap-rieng-tu; PUT-vs-POST de-ban-sao; peTenGoiThau; winnerSupplierNames; Content-Disposition RFC6266; LEFT-join Projects) -> 11 FIXED + 1 GIU (F-10 ke thua khuon PE, bit dong bo sau)
- tests: +8 (574 total 0 fail) — authz reflection dong + Create/Delete/guard/khong-dot-ma-khi-409 + fixture-co-interceptor

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fe-admin/src/components/Layout.tsx

@@ -29,14 +29,15 @@ const TYPE_CODE_TO_INT: Record<string, number> = {
 // Ct_<Type>_<Action> sub-menu entries.
 function resolvePath(key: string): string | null {
   const staticMap: Record<string, string> = {
-    // [S159-đợt3] skeleton GĐ2/GĐ4 — leaf trỏ trang "Sắp triển khai" (query giữ
-    // active-state riêng từng mục; gotcha #50: thiếu route = sidebar drop SILENT).
-    Khkk_WfView: '/coming-soon?stage=2&m=wfview',
-    Khkk_List: '/coming-soon?stage=2&m=list',
-    Khkk_Create: '/coming-soon?stage=2&m=create',
-    Khkk_Pending: '/coming-soon?stage=2&m=pending',
-    Khkk_Approved: '/coming-soon?stage=2&m=approved',
-    Khkk_Deleted: '/coming-soon?stage=2&m=deleted', // [S159-đợt5 FLAG-1] thiếu là leaf drop SILENT (gotcha #50)
+    // [W2 KHKK S161] GĐ2 hết skeleton — re-point trang thật (gotcha #50: thiếu route =
+    // sidebar drop SILENT). WfView phía admin trỏ Designer type-10 (fe-admin CỐ Ý không có
+    // matrix page — chốt 2026-07-27; admin "Luồng duyệt" = dựng/sửa quy trình).
+    Khkk_WfView: '/system/approval-workflows-v2/ContractSigningPlan',
+    Khkk_List: '/khkk/list',
+    Khkk_Create: '/khkk/create',
+    Khkk_Pending: '/khkk/list?filter=ChoDuyet',
+    Khkk_Approved: '/khkk/list?filter=DaDuyet',
+    Khkk_Deleted: '/khkk/list?view=deleted', // [S159-đợt5 FLAG-1] thiếu là leaf drop SILENT (gotcha #50)
     Hdc_ThauPhu: '/coming-soon?stage=4&t=01',
     Hdc_GiaoKhoan: '/coming-soon?stage=4&t=02',
     Hdc_NhaCungCap: '/coming-soon?stage=4&t=03',