[CLAUDE] Tests Phase 1: Domain unit tests + CI gate (xUnit + FluentAssertions)

Phase 1 (MVP) — chống regression Workflow state machine. 54 test pure
function (no DB / IO), all pass < 7 giây.

Test project:
- tests/SolutionErp.Domain.Tests/ (xUnit 2.9.3 + FluentAssertions 7.2 — pin trước v8 commercial license)
- ProjectReference SolutionErp.Domain
- Added vào SolutionErp.slnx folder /tests/

Test files:
- Contracts/WorkflowPolicyTests.cs (~17 test):
  - Standard policy 9-phase: role transitions, CCM check, BOD signing, terminal
  - SkipCcm policy 7-phase: bypass CCM verify, no DangKiemTraCCM transition
  - Registry: DefaultPolicyName per ContractType (7 type), bypass flag override
  - FromDefinition versioned: build từ ordered steps + reject path + TuChoi auto-add + UserKindApprover populate UserTransitions
- PurchaseEvaluations/PurchaseEvaluationPolicyTests.cs (~17 test):
  - NccOnly (A) 3-step: skip ChoDuAn + ChoCEODuyetPA, CCM đẩy thẳng CEO duyệt NCC
  - NccWithPlan (B) 5-step: có ChoDuAn (PM) + ChoCEODuyetPA (Director) trước
  - Reject path cả 2 quy trình về DangSoanThao
  - Registry mapping per PEType
- Budgets/BudgetPolicyTests.cs (~13 test):
  - Default 3-step (Drafter→CCM→CEO) role guard
  - Reject paths về DangSoanThao
  - DaDuyet + TuChoi terminal (no NextPhases)
  - SLA spec 5d/3d/2d cho 3 phase đầu

CI gate (.gitea/workflows/deploy.yml):
- Step "Run unit tests (Domain)" thêm TRƯỚC build/publish/deploy
- Test fail (LASTEXITCODE != 0) → exit → KHÔNG deploy
- TRX log saved + upload artifact (continue-on-error nếu Gitea runner thiếu actions/upload-artifact)

Verify local:
- dotnet test tests/SolutionErp.Domain.Tests → Total tests: 54 / Passed: 54 / 6.4s
- dotnet build SolutionErp.slnx (full solution incl. test project) → 0 error

Phase 2-5 pending (xem plan ở chat):
- Code generator atomic concurrency tests (Infra)
- DbInitializer reconcile drift tests (Infra)
- Application handler smoke tests (CQRS) với EF InMemory
- API smoke tests qua WebApplicationFactory
- FE Vitest cho lib utility (queryMatches, fmtMoney)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -29,6 +29,30 @@ jobs:
           & 'C:\Program Files\nodejs\node.exe' --version
           & 'C:\Program Files\nodejs\npm.cmd' --version
 
+      # ============== TEST GATE ==============
+      # Run unit tests TRƯỚC build/publish/deploy. Test fail → exit non-zero
+      # → toàn bộ job stop, KHÔNG deploy. Phase 1 chỉ Domain layer (~54 test
+      # phase machine + policy registry). Mở rộng Application/Infra/Api
+      # khi có nhu cầu (xem docs/changelog/migration-todos.md).
+      - name: Run unit tests (Domain)
+        shell: powershell
+        run: |
+          & 'C:\Program Files\dotnet\dotnet.exe' test tests/SolutionErp.Domain.Tests/SolutionErp.Domain.Tests.csproj `
+            --configuration Release `
+            --logger "trx;LogFileName=domain-tests.trx" `
+            --results-directory test-results
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Upload test results
+        if: always()
+        continue-on-error: true   # nếu Gitea runner chưa có upload-artifact action, skip không block deploy
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: test-results/*.trx
+          retention-days: 14
+
+      # ============== BUILD ==============
       - name: Build backend
         shell: powershell
         run: |