[CLAUDE] Api: PATCH /users/{id}/position-level endpoint (Chunk E)

Endpoint mới mirror SetBypassReview pattern:
- PATCH /api/users/{id}/position-level
- Body: { positionLevel: int? } (1=NV, 2=PP, 3=TP, null=clear)
- Authorize Policy "Users.Update"
- Send SetUserPositionLevelCommand qua MediatR

PE Workflow Designer admin Create/Get endpoint KHÔNG cần đụng — record
DTO `CreatePeWorkflowDefinitionCommand` đã extend với InnerSteps (default
null) ở Chunk B, JSON body bind tự động qua existing controller.

Verify: dotnet build 0 error 0 warning · 89 test pass (no regression).

Pending Chunk F: FE Designer InnerSteps sub-section + UsersPage column
"Cấp" + Docs/Skill update (cuối cùng).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Controllers/UsersController.cs

@@ -72,8 +72,21 @@ public class UsersController(IMediator mediator) : ControllerBase
         await mediator.Send(new SetUserBypassReviewCommand(id, body.CanBypassReview), ct);
         return NoContent();
     }
+
+    // N-stage workflow inner step (Mig 18): admin set cấp chức danh user
+    // (1=NV, 2=PP, 3=TP, null=admin/external). Body PositionLevel int? — null
+    // sẽ clear PositionLevel của user.
+    [HttpPatch("{id:guid}/position-level")]
+    [Authorize(Policy = "Users.Update")]
+    public async Task<IActionResult> SetPositionLevel(
+        Guid id, [FromBody] SetPositionLevelBody body, CancellationToken ct)
+    {
+        await mediator.Send(new SetUserPositionLevelCommand(id, body.PositionLevel), ct);
+        return NoContent();
+    }
 }
 
 public record AssignRolesBody(List<string> Roles);
 public record ResetPasswordBody(string NewPassword);
 public record SetBypassReviewBody(bool CanBypassReview);
+public record SetPositionLevelBody(int? PositionLevel);