[CLAUDE] App+Infra+Api+FE: SignalR realtime notifications E2E

Clean-arch split:
- Application: IRealtimeNotifier (PushToUserAsync, abstraction)
- Api: NotificationHub (/hubs/notifications, [Authorize]) +
  SignalRNotifier impl với IHubContext<NotificationHub>, uses
  Clients.User(userId) (default provider resolves NameIdentifier="sub")
- Infrastructure: NotificationPushInterceptor — SaveChangesInterceptor
  capture Notification entities state=Added trong SavingChanges,
  push qua IRealtimeNotifier trong SavedChanges sau khi commit thành
  công. Zero caller changes — handlers chỉ cần db.Add(Notification).
  Attached vào ApplicationDbContext cùng với AuditingInterceptor.

Auth:
- JWT config thêm OnMessageReceived event: read ?access_token= từ
  query string khi path = /hubs/* (WebSockets không set headers).
- SignalRNotifier singleton (stateless, chỉ delegate IHubContext).

FE (both apps):
- @microsoft/signalr 8.0.7 vào package.json.
- lib/realtime.ts: singleton connection với lazy start + automatic
  reconnect [0,2s,5s,10s,15s] + accessTokenFactory lấy từ localStorage.
- NotificationBell: useEffect subscribe 'notification-created' khi
  isAuthenticated. On push: invalidate query + toast.message. Fallback
  polling giảm từ 30s → 60s (realtime cover gap).
- AuthContext.logout: dynamic import stopConnection() — avoid leaking
  auth'd socket across users.

Result: ERP-grade feel. Contract transition → Drafter nhận toast ngay
trong vòng 100-300ms (same-origin WebSocket), không cần F5 hay polling.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fe-admin/src/components/NotificationBell.tsx

@@ -2,7 +2,10 @@ import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useEffect, useRef, useState } from 'react'
 import { Bell, CheckCheck } from 'lucide-react'
 import { useNavigate } from 'react-router-dom'
+import { toast } from 'sonner'
 import { api } from '@/lib/api'
+import { ensureConnection } from '@/lib/realtime'
+import { useAuth } from '@/contexts/AuthContext'
 import { cn } from '@/lib/cn'
 
 type NotificationDto = {
@@ -32,13 +35,42 @@ export function NotificationBell() {
   const panelRef = useRef<HTMLDivElement>(null)
   const navigate = useNavigate()
   const qc = useQueryClient()
+  const { isAuthenticated } = useAuth()
 
   const list = useQuery({
     queryKey: ['notifications'],
     queryFn: async () => (await api.get<NotificationDto[]>('/notifications', { params: { limit: 20 } })).data,
-    refetchInterval: 30_000,
+    // Fallback polling at 60s in case SignalR disconnects + reconnect fails
+    refetchInterval: 60_000,
   })
 
+  // Subscribe realtime when authenticated. Toast on push + invalidate query.
+  useEffect(() => {
+    if (!isAuthenticated) return
+    let conn: Awaited<ReturnType<typeof ensureConnection>> | null = null
+    let cancelled = false
+
+    const handler = (payload: NotificationDto) => {
+      qc.invalidateQueries({ queryKey: ['notifications'] })
+      toast.message(payload.title, { description: payload.description ?? undefined })
+    }
+
+    ensureConnection()
+      .then(c => {
+        if (cancelled) return
+        conn = c
+        c.on('notification-created', handler)
+      })
+      .catch(() => {
+        // SignalR unavailable — rely on polling fallback
+      })
+
+    return () => {
+      cancelled = true
+      if (conn) conn.off('notification-created', handler)
+    }
+  }, [isAuthenticated, qc])
+
   const items = list.data ?? []
   const unread = items.filter(n => !n.readAt).length