[CLAUDE] PurchaseEvaluation: PE gắn Hạng mục công việc (Mig 49) + mở quyền Pe all-role + menu Cá nhân + khóa 14 demo user

Sếp chốt deadline 15:00 (Zalo 11:02-11:17): flow tạo phiếu chọn quy trình → dự án → HẠNG MỤC → NCC/TP; phiếu dạng «Dự án – Hạng mục»; all-user thấy Duyệt NCC + master config; clear data cũ.

- Mig 49 AddWorkItemToPurchaseEvaluation: PE.WorkItemId Guid? loose-Guid + index (KHÔNG FK vật lý — convention PE, database-agent design). Validator NotEmpty (create) + FK-guard AnyAsync(IsActive) → Conflict + UpdateDraft NULL-SAFE (client không gửi → giữ, chống null-hóa bug-class S42). 3 projection ListItemDto LEFT-join WorkItems.
- FE ×2 app: PeWorkspaceCreateView select «c. Hạng mục *» + PeHeaderForm (load existing + PUT gửi lại, SHA256 IDENTICAL) + PeDetailTabs (header «Dự án – Hạng mục» + FormRow + inline khóa) + types. Route reuse /catalogs/work-items.
- Perm: SeedAllRolesReviewReadPermissionsAsync extend Pe_* 11 key (factory — Pe leaf không nằm All) CanRead+CanCreate upgrade-only mọi role; PeWf_*/AwV2 GIỮ Admin. HRM/Office/Master/Catalogs CanRead (S57). Master write-lock Admin,CatalogManager ×3 controller.
- Menu «Cá nhân» (Personal root 30, mirror Puro) + Chấm công re-parent + HrmConfig→Master + parentBackfill idempotent + admin bỏ ẩn Master (đảo S29).
- LockDemoSampleUsersAsync: khóa 14/16 sample (GIỮ nv.cao+nv.truong IT-pool + catalog.manager) — ungated idempotent, IsActive=0+Lockout+SecurityStamp rotate.
- Tests +12 PeWorkItemGuardTests (validator/FK-guard/null-safe) → 240 PASS. npm ×2 + BE 0W/0E.
- Excel (3) đối chiếu: 62/71/3 identical S55 — no data change.
- Gate: em main evidence-checklist (2 reviewer-spawn die-0-byte — resume-kill; backstop 12 guard-test + authz-key/role-string/Mig-49 evidence-lệnh).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Controllers/DepartmentsController.cs

@@ -22,6 +22,9 @@ public class DepartmentsController(IMediator mediator) : ControllerBase
     public async Task<ActionResult<DepartmentDto>> Get(Guid id, CancellationToken ct)
         => Ok(await mediator.Send(new GetDepartmentQuery(id), ct));
 
+    // [S57] Master write khóa Admin+CatalogManager (đọc mở cho mọi role; chống sửa/xóa
+    // Phòng ban qua API khi mở quyền xem cho toàn bộ nhân viên).
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPost]
     public async Task<ActionResult<Guid>> Create([FromBody] CreateDepartmentCommand cmd, CancellationToken ct)
     {
@@ -29,6 +32,7 @@ public class DepartmentsController(IMediator mediator) : ControllerBase
         return CreatedAtAction(nameof(Get), new { id }, new { id });
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPut("{id:guid}")]
     public async Task<IActionResult> Update(Guid id, [FromBody] UpdateDepartmentCommand cmd, CancellationToken ct)
     {
@@ -37,6 +41,7 @@ public class DepartmentsController(IMediator mediator) : ControllerBase
         return NoContent();
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {

src/Backend/SolutionErp.Api/Controllers/ProjectsController.cs

@@ -22,6 +22,9 @@ public class ProjectsController(IMediator mediator) : ControllerBase
     public async Task<ActionResult<ProjectDto>> Get(Guid id, CancellationToken ct)
         => Ok(await mediator.Send(new GetProjectQuery(id), ct));
 
+    // [S57] Master write khóa Admin+CatalogManager (đọc mở cho mọi role; chống sửa/xóa
+    // 62 dự án production qua API khi mở quyền xem cho toàn bộ nhân viên).
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPost]
     public async Task<ActionResult<Guid>> Create([FromBody] CreateProjectCommand cmd, CancellationToken ct)
     {
@@ -29,6 +32,7 @@ public class ProjectsController(IMediator mediator) : ControllerBase
         return CreatedAtAction(nameof(Get), new { id }, new { id });
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPut("{id:guid}")]
     public async Task<IActionResult> Update(Guid id, [FromBody] UpdateProjectCommand cmd, CancellationToken ct)
     {
@@ -37,6 +41,7 @@ public class ProjectsController(IMediator mediator) : ControllerBase
         return NoContent();
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {

src/Backend/SolutionErp.Api/Controllers/SuppliersController.cs

@@ -29,6 +29,9 @@ public class SuppliersController(IMediator mediator) : ControllerBase
     public async Task<ActionResult<SupplierDto>> Get(Guid id, CancellationToken ct)
         => Ok(await mediator.Send(new GetSupplierQuery(id), ct));
 
+    // [S57] Master write khóa Admin+CatalogManager (đọc mở cho mọi role review/test;
+    // chống nhân viên sửa/xóa NCC production qua API khi menu hiện cho toàn bộ phận).
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPost]
     public async Task<ActionResult<Guid>> Create([FromBody] CreateSupplierCommand cmd, CancellationToken ct)
     {
@@ -36,6 +39,7 @@ public class SuppliersController(IMediator mediator) : ControllerBase
         return CreatedAtAction(nameof(Get), new { id }, new { id });
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpPut("{id:guid}")]
     public async Task<IActionResult> Update(Guid id, [FromBody] UpdateSupplierCommand cmd, CancellationToken ct)
     {
@@ -44,6 +48,7 @@ public class SuppliersController(IMediator mediator) : ControllerBase
         return NoContent();
     }
 
+    [Authorize(Roles = "Admin,CatalogManager")]
     [HttpDelete("{id:guid}")]
     public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
     {