[CLAUDE] FE-Admin+Domain+Infra+App: Workflows tab → sidebar menu items

User request: 7 tab trong /system/workflows thành menu items riêng.

Domain:
- MenuKeys.WorkflowTypeLeaf(code) helper — `Wf_<TypeCode>` pattern

Infrastructure (DbInitializer):
- Seed 7 leaves dưới Workflows group (order 95..101), label matches
  ContractType (HĐ Thầu phụ / Giao khoán / NCC / Dịch vụ / Mua bán /
  Nguyên tắc NCC / Nguyên tắc Dịch vụ). Idempotent.

Application (GetMyMenuTreeQuery):
- Generalized inherit-perm logic: descendants of Contracts AND Workflows
  inherit parent CanRead flag. Single Workflows.Read grant → all 7
  Wf_* leaves visible; no per-leaf permission rows needed.

FE Layout (admin):
- resolvePath: Wf_<Code> → /system/workflows/<code>. Ct_* still hidden
  on admin side.

FE App.tsx:
- New route /system/workflows/:typeCode?

FE WorkflowsPage:
- Removed horizontal tab bar; type selection now comes từ URL param.
- Landing view (no param): 3-col grid card per type với active version
  badge — so admin có visual overview khi click top-level Workflows
  group without selecting a type.
- TYPE_CODE_TO_INT map drives URL→int conversion.

Result: click `Quy trình HĐ > HĐ Mua bán` trong sidebar → opens
/system/workflows/MuaBan directly với designer scoped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fe-admin/src/components/Layout.tsx

@@ -52,11 +52,19 @@ function resolvePath(key: string): string | null {
     if (action === 'Create') return `/contracts/new?type=${typeInt}`
     if (action === 'Pending') return `/contracts?type=${typeInt}&pendingMe=1`
   }
+
+  // Workflow admin per ContractType: Wf_<Code> → /system/workflows/<code>
+  const wfMatch = key.match(/^Wf_(.+)$/)
+  if (wfMatch) {
+    const code = wfMatch[1]
+    if (TYPE_CODE_TO_INT[code]) return `/system/workflows/${code}`
+  }
+
   return null
 }
 
-// Admin side: hide the per-ContractType submenu (Ct_*) — that's a user-app
-// concern. Admin manages workflow config via /system/workflows instead.
+// Admin side: hide the per-ContractType contract submenu (Ct_*) — that's a
+// user-app concern. Keep Wf_* workflow-admin leaves.
 function isAdminHidden(key: string): boolean {
   return key.startsWith('Ct_')
 }