[CLAUDE] App+Infra+Api+FE: SignalR realtime notifications E2E

Clean-arch split:
- Application: IRealtimeNotifier (PushToUserAsync, abstraction)
- Api: NotificationHub (/hubs/notifications, [Authorize]) +
  SignalRNotifier impl với IHubContext<NotificationHub>, uses
  Clients.User(userId) (default provider resolves NameIdentifier="sub")
- Infrastructure: NotificationPushInterceptor — SaveChangesInterceptor
  capture Notification entities state=Added trong SavingChanges,
  push qua IRealtimeNotifier trong SavedChanges sau khi commit thành
  công. Zero caller changes — handlers chỉ cần db.Add(Notification).
  Attached vào ApplicationDbContext cùng với AuditingInterceptor.

Auth:
- JWT config thêm OnMessageReceived event: read ?access_token= từ
  query string khi path = /hubs/* (WebSockets không set headers).
- SignalRNotifier singleton (stateless, chỉ delegate IHubContext).

FE (both apps):
- @microsoft/signalr 8.0.7 vào package.json.
- lib/realtime.ts: singleton connection với lazy start + automatic
  reconnect [0,2s,5s,10s,15s] + accessTokenFactory lấy từ localStorage.
- NotificationBell: useEffect subscribe 'notification-created' khi
  isAuthenticated. On push: invalidate query + toast.message. Fallback
  polling giảm từ 30s → 60s (realtime cover gap).
- AuthContext.logout: dynamic import stopConnection() — avoid leaking
  auth'd socket across users.

Result: ERP-grade feel. Contract transition → Drafter nhận toast ngay
trong vòng 100-300ms (same-origin WebSocket), không cần F5 hay polling.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fe-admin/src/lib/realtime.ts

@@ -0,0 +1,48 @@
+import { HubConnection, HubConnectionBuilder, HubConnectionState, LogLevel } from '@microsoft/signalr'
+import { TOKEN_KEY } from '@/lib/api'
+
+// Hub URL resolution:
+// - Dev: Vite proxy forwards /api → :5443 but SignalR bypasses axios, so we
+//   hit the API origin directly from the browser.
+// - Prod: VITE_API_BASE_URL (https://api.huypham.vn)
+const HUB_URL = (import.meta.env.VITE_API_BASE_URL ?? window.location.origin) + '/hubs/notifications'
+
+let connection: HubConnection | null = null
+let startPromise: Promise<void> | null = null
+
+/** Lazily starts (or reuses) a single hub connection. Token read on connect. */
+export async function ensureConnection(): Promise<HubConnection> {
+  if (connection && connection.state === HubConnectionState.Connected) return connection
+
+  if (!connection) {
+    connection = new HubConnectionBuilder()
+      .withUrl(HUB_URL, {
+        accessTokenFactory: () => localStorage.getItem(TOKEN_KEY) ?? '',
+      })
+      .withAutomaticReconnect([0, 2_000, 5_000, 10_000, 15_000]) // exponential-ish backoff
+      .configureLogging(LogLevel.Warning)
+      .build()
+  }
+
+  if (connection.state === HubConnectionState.Disconnected) {
+    startPromise ??= connection.start().catch(err => {
+      startPromise = null
+      throw err
+    })
+    await startPromise
+    startPromise = null
+  }
+  return connection
+}
+
+/** Stops + forgets the connection. Call on logout. */
+export async function stopConnection(): Promise<void> {
+  if (!connection) return
+  try {
+    await connection.stop()
+  } catch {
+    /* ignore */
+  }
+  connection = null
+  startPromise = null
+}