[CLAUDE] App+Api+FE-User+FE-Admin+Tests: W2 KHKK — CRUD phieu nhap + can cu b.8-9 + FE 3 page x2 app + 12 fix reviewer

- BE mega-file ContractSigningPlanFeatures (Create 4-rao + auto-Lines snapshot per-winner + MaKeHoach @CREATE + UpdateDraft null-safe + Get/List/inbox-precompute-V2/deleted + Dossier + Attachments + Delete allow-list M6 + picker) + Controller 15 action policy per-action 15/15 (KeHoachKyKet.*)
- FE pages/khkk 3 page + types x2 app SHA-pair + 4-place (6 leaf Khkk_* het coming-soon; WfView: user=matrix?type=10 [whitelist +10] / admin=Designer deep-link); root KeHoachKyKet -> /khkk/list
- Reviewer adversarial: 12 finding (3 CRITICAL dut-2-bo FE-BE: route picker + peId body + dossier planId; 2 MAJOR security: detail+download 0 rao -> EnsureCanViewAsync mirror PE S89 nhap-rieng-tu; PUT-vs-POST de-ban-sao; peTenGoiThau; winnerSupplierNames; Content-Disposition RFC6266; LEFT-join Projects) -> 11 FIXED + 1 GIU (F-10 ke thua khuon PE, bit dong bo sau)
- tests: +8 (574 total 0 fail) — authz reflection dong + Create/Delete/guard/khong-dot-ma-khi-409 + fixture-co-interceptor

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Backend/SolutionErp.Domain/ContractSigningPlans/ContractSigningPlan.cs

@@ -14,7 +14,12 @@ namespace SolutionErp.Domain.ContractSigningPlans;
 // nội bộ module (Lines/DossierItems/... Cascade) + ApprovalWorkflowId → bảng V2 dùng chung.
 public class ContractSigningPlan : AuditableEntity
 {
-    public string? MaKeHoach { get; set; }               // "KHKK/2026/001" — gen atomic lúc Submit (W2)
+    // [W2 S161] "KHKK/2026/001" — gen atomic NGAY LÚC TẠO phiếu (POST trả về mã liền).
+    // 🔴 Đính chính comment W1 ("gen lúc Submit"): spec W2 §③-B chốt acceptance
+    // `POST /api/contract-signing-plans` → mã khớp `^KHKK/\d{4}/\d{3}$` ⇒ không thể defer
+    // tới Submit. Vẫn để nullable vì cột đã sinh nullable ở Mig 69 (không đổi schema) —
+    // phiếu tạo bằng đường CQRS luôn có mã.
+    public string? MaKeHoach { get; set; }
 
     public Guid PurchaseEvaluationId { get; set; }       // loose-Guid + IX — phiếu PE nguồn (DaDuyet)
     public Guid ProjectId { get; set; }                  // denorm để lọc list (loose-Guid, mirror PE)