[CLAUDE] Api+App: Chunk B — PATCH /menus/{key} + DTO extend isVisible/displayLabel

Session 20 turn 7 Chunk B. BE API cho admin Ẩn/Hiện + Đổi tên menu fe-user.

DTO (MenuDtos.cs):
  - MenuNodeDto +IsVisible bool +DisplayLabel string?
  - MenuItemDto +IsVisible bool +DisplayLabel string?

GetMyMenuTreeQueryHandler:
  - Pass m.IsVisible + m.DisplayLabel vào MenuNodeDto record
  - KHÔNG filter IsVisible server-side (FE 2 app tự filter — fe-admin
    render hết, fe-user filter ẩn). Lý do: 1 endpoint serve cả 2 FE.

ListMenuItemsQueryHandler: +IsVisible +DisplayLabel trong Select projection.

NEW UpdateMenuItemCommand + Validator + Handler (PermissionFeatures.cs):
  - Body: { Key, IsVisible, DisplayLabel? }
  - Validator: Key required + max 50, DisplayLabel max 200
  - Handler: load MenuItem by Key (NotFoundException nếu missing), set
    IsVisible + DisplayLabel (whitespace → null normalize), SaveChangesAsync

MenusController +PATCH /api/menus/{key}:
  - [Authorize(Policy = "Permissions.Update")] — reuse policy admin matrix
  - Body: UpdateMenuItemRequest { IsVisible, DisplayLabel? }
  - Send UpdateMenuItemCommand qua MediatR
  - Return 204 NoContent

Verify:
- dotnet build SolutionErp.slnx — 0 err (1 warn cũ DocxRenderer không liên quan)

Pending Chunk C: FE Admin MenuVisibilityPage
Pending Chunk D: FE Layout fe-user filter + render displayLabel
Pending Chunk E: Docs S20 turn 7

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Controllers/MenusController.cs

@@ -19,4 +19,17 @@ public class MenusController(IMediator mediator) : ControllerBase
     [HttpGet]
     public async Task<ActionResult<List<MenuItemDto>>> List(CancellationToken ct)
         => Ok(await mediator.Send(new ListMenuItemsQuery(), ct));
+
+    // [Mig 27] Admin Ẩn/Hiện + Đổi tên hiển thị menu cho fe-user. Body shape khớp
+    // UpdateMenuItemCommand. Authorize policy "Permissions.Update" (admin matrix
+    // quản lý phân quyền — cùng scope).
+    public record UpdateMenuItemRequest(bool IsVisible, string? DisplayLabel);
+
+    [HttpPatch("{key}")]
+    [Authorize(Policy = "Permissions.Update")]
+    public async Task<IActionResult> Update(string key, [FromBody] UpdateMenuItemRequest body, CancellationToken ct)
+    {
+        await mediator.Send(new UpdateMenuItemCommand(key, body.IsVisible, body.DisplayLabel), ct);
+        return NoContent();
+    }
 }