[CLAUDE] App+Infra+Api+FE: SignalR realtime notifications E2E

Clean-arch split:
- Application: IRealtimeNotifier (PushToUserAsync, abstraction)
- Api: NotificationHub (/hubs/notifications, [Authorize]) +
  SignalRNotifier impl với IHubContext<NotificationHub>, uses
  Clients.User(userId) (default provider resolves NameIdentifier="sub")
- Infrastructure: NotificationPushInterceptor — SaveChangesInterceptor
  capture Notification entities state=Added trong SavingChanges,
  push qua IRealtimeNotifier trong SavedChanges sau khi commit thành
  công. Zero caller changes — handlers chỉ cần db.Add(Notification).
  Attached vào ApplicationDbContext cùng với AuditingInterceptor.

Auth:
- JWT config thêm OnMessageReceived event: read ?access_token= từ
  query string khi path = /hubs/* (WebSockets không set headers).
- SignalRNotifier singleton (stateless, chỉ delegate IHubContext).

FE (both apps):
- @microsoft/signalr 8.0.7 vào package.json.
- lib/realtime.ts: singleton connection với lazy start + automatic
  reconnect [0,2s,5s,10s,15s] + accessTokenFactory lấy từ localStorage.
- NotificationBell: useEffect subscribe 'notification-created' khi
  isAuthenticated. On push: invalidate query + toast.message. Fallback
  polling giảm từ 30s → 60s (realtime cover gap).
- AuthContext.logout: dynamic import stopConnection() — avoid leaking
  auth'd socket across users.

Result: ERP-grade feel. Contract transition → Drafter nhận toast ngay
trong vòng 100-300ms (same-origin WebSocket), không cần F5 hay polling.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Hubs/NotificationHub.cs

@@ -0,0 +1,15 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.SignalR;
+
+namespace SolutionErp.Api.Hubs;
+
+// JWT-authenticated hub. Users subscribe automatically to their own channel via
+// Clients.User(userId) — SignalR resolves userId via IUserIdProvider (default
+// uses ClaimTypes.NameIdentifier which our JWT sets to "sub").
+[Authorize]
+public class NotificationHub : Hub
+{
+    // Client-callable ping for heartbeat/debug. Clients auto-join their user
+    // channel on connect — no explicit join method needed.
+    public string Ping() => "pong";
+}

src/Backend/SolutionErp.Api/Hubs/SignalRNotifier.cs

@@ -0,0 +1,15 @@
+using Microsoft.AspNetCore.SignalR;
+using SolutionErp.Application.Common.Interfaces;
+
+namespace SolutionErp.Api.Hubs;
+
+public class SignalRNotifier(IHubContext<NotificationHub> hub) : IRealtimeNotifier
+{
+    public async Task PushToUserAsync(Guid userId, string eventName, object payload, CancellationToken ct = default)
+    {
+        // Clients.User(userId) uses default IUserIdProvider → reads
+        // ClaimTypes.NameIdentifier. Our JWT places the user id in "sub"
+        // which ASP.NET maps to NameIdentifier, so this resolves correctly.
+        await hub.Clients.User(userId.ToString()).SendAsync(eventName, payload, ct);
+    }
+}

src/Backend/SolutionErp.Api/Program.cs

@@ -9,6 +9,7 @@ using Microsoft.IdentityModel.Tokens;
 using Microsoft.OpenApi.Models;
 using Serilog;
 using SolutionErp.Api.Authorization;
+using SolutionErp.Api.Hubs;
 using SolutionErp.Api.Middleware;
 using SolutionErp.Api.Services;
 using SolutionErp.Application;
@@ -27,6 +28,8 @@ builder.Host.UseSerilog((ctx, cfg) => cfg
 
 // ---------- Core services ----------
 builder.Services.AddControllers();
+builder.Services.AddSignalR();
+builder.Services.AddSingleton<IRealtimeNotifier, SignalRNotifier>();
 builder.Services.AddHttpContextAccessor();
 builder.Services.AddScoped<ICurrentUser, CurrentUserService>();
 builder.Services.AddSingleton<SolutionErp.Application.Forms.IWebHostEnvironmentLocator, SolutionErp.Api.Services.WebHostEnvironmentLocator>();
@@ -54,6 +57,19 @@ builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt.Secret)),
             ClockSkew = TimeSpan.FromMinutes(1),
         };
+        // SignalR WebSockets can't set Authorization header — read JWT from
+        // ?access_token=... query param when the request targets /hubs/*
+        options.Events = new JwtBearerEvents
+        {
+            OnMessageReceived = ctx =>
+            {
+                var accessToken = ctx.Request.Query["access_token"];
+                var path = ctx.HttpContext.Request.Path;
+                if (!string.IsNullOrEmpty(accessToken) && path.StartsWithSegments("/hubs"))
+                    ctx.Token = accessToken;
+                return Task.CompletedTask;
+            }
+        };
     });
 
 builder.Services.AddScoped<IAuthorizationHandler, MenuPermissionHandler>();
@@ -171,6 +187,7 @@ app.MapHealthChecks("/health/live", new HealthCheckOptions { Predicate = _ => fa
 app.MapHealthChecks("/health/ready", new HealthCheckOptions { Predicate = h => h.Tags.Contains("ready") });
 
 app.MapControllers();
+app.MapHub<NotificationHub>("/hubs/notifications");
 
 // ---------- DB init + seed ----------
 if (!args.Contains("--no-db-init"))