[CLAUDE] App+Api+FE-User+FE-Admin+Tests: W2 KHKK — CRUD phieu nhap + can cu b.8-9 + FE 3 page x2 app + 12 fix reviewer

- BE mega-file ContractSigningPlanFeatures (Create 4-rao + auto-Lines snapshot per-winner + MaKeHoach @CREATE + UpdateDraft null-safe + Get/List/inbox-precompute-V2/deleted + Dossier + Attachments + Delete allow-list M6 + picker) + Controller 15 action policy per-action 15/15 (KeHoachKyKet.*)
- FE pages/khkk 3 page + types x2 app SHA-pair + 4-place (6 leaf Khkk_* het coming-soon; WfView: user=matrix?type=10 [whitelist +10] / admin=Designer deep-link); root KeHoachKyKet -> /khkk/list
- Reviewer adversarial: 12 finding (3 CRITICAL dut-2-bo FE-BE: route picker + peId body + dossier planId; 2 MAJOR security: detail+download 0 rao -> EnsureCanViewAsync mirror PE S89 nhap-rieng-tu; PUT-vs-POST de-ban-sao; peTenGoiThau; winnerSupplierNames; Content-Disposition RFC6266; LEFT-join Projects) -> 11 FIXED + 1 GIU (F-10 ke thua khuon PE, bit dong bo sau)
- tests: +8 (574 total 0 fail) — authz reflection dong + Create/Delete/guard/khong-dot-ma-khi-409 + fixture-co-interceptor

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

fe-user/src/components/Layout.tsx

@@ -54,12 +54,12 @@ const INT_TO_PE_CODE: Record<number, string> = Object.fromEntries(
 // /my-contracts (user's own drafts), Duyệt to /inbox (pending THEIR approval).
 function resolvePath(key: string): string | null {
   const staticMap: Record<string, string> = {
-    // [S159-đợt3] skeleton GĐ2/GĐ4 — leaf trỏ trang "Sắp triển khai" (query giữ
-    // active-state riêng từng mục; gotcha #50: thiếu route = sidebar drop SILENT).
-    Khkk_List: '/coming-soon?stage=2&m=list',
-    Khkk_Create: '/coming-soon?stage=2&m=create',
-    Khkk_Pending: '/coming-soon?stage=2&m=pending',
-    Khkk_Approved: '/coming-soon?stage=2&m=approved',
+    // [W2 KHKK S161] GĐ2 hết skeleton — 6 leaf re-point trang thật (gotcha #50:
+    // thiếu route = sidebar drop SILENT; filter đi qua query param, page map FILTER_TO_PHASE).
+    Khkk_List: '/khkk/list',
+    Khkk_Create: '/khkk/create',
+    Khkk_Pending: '/khkk/list?filter=ChoDuyet',
+    Khkk_Approved: '/khkk/list?filter=DaDuyet',
     Hdc_ThauPhu: '/coming-soon?stage=4&t=01',
     Hdc_GiaoKhoan: '/coming-soon?stage=4&t=02',
     Hdc_NhaCungCap: '/coming-soon?stage=4&t=03',
@@ -73,11 +73,11 @@ function resolvePath(key: string): string | null {
     // [S159 2026-07-29] 2 root placeholder giai đoạn 2/4 (owner: menu hiển thị đúng 4 GĐ
     // như tab strip). Module chưa build → trỏ về Tổng quan pipeline (khung "Sắp triển khai").
     // LESSON gotcha #50: key DB mới PHẢI có route ở đây, không thì sidebar drop SILENT.
-    KeHoachKyKet: '/dashboard',
+    KeHoachKyKet: '/khkk/list',   // [W2 S161] root GĐ2 hết placeholder — về danh sách phiếu
     HopDongCung: '/dashboard',
-    // [S159-đợt5] 2 leaf mới của skeleton GĐ2 (đủ 6 y chang Duyệt NCC)
-    Khkk_WfView: '/coming-soon?stage=2&m=wfview',
-    Khkk_Deleted: '/coming-soon?stage=2&m=deleted',
+    // [W2 S161] 2 leaf còn lại — WfView đi alias matrix type=10 (App.tsx, không đẻ page mới)
+    Khkk_WfView: '/khkk/workflow-matrix?type=10',
+    Khkk_Deleted: '/khkk/list?view=deleted',
     // [Plan CA Hotfix 1 S29 2026-05-22] 4 master + 4 catalog leaf moved từ
     // fe-admin → fe-user. resolvePath PHẢI có route mapping nếu không
     // MenuLeaf line 238 `if (!path) return null` → sidebar drop silent.