[CLAUDE] Domain+App+Infra+Api+FE-Admin+FE-User: S36 Plan G-O2 Phòng họp Mig 36 + BE CRUD + FE 2 app

Phase 10.2 G-O2 Phòng họp BookingCalendar — Mig 36 schema + BE CQRS + FE 2 app
mirror cookie-cutter G-H2 HrmConfig pattern. Standalone không depend workflow.

BE schema (Mig 36 — em main solo Step 4):
- 4 Domain new: MeetingRoom catalog + MeetingBooking header + MeetingBookingAttendee
  join table N-to-N (NOT JSON per Investigator verdict) + Enums (MeetingBookingStatus
  3-state: Confirmed/Cancelled/Completed)
- 3 EF Config: UNIQUE Code + composite index (RoomId, StartAt) range query + UNIQUE
  composite (BookingId, UserId) join
- FK strategy: Room→Restrict (preserve history) + Booking→Cascade attendees +
  User→Restrict (denorm FullName+Email tránh cascade wipe)
- Mig 36 3-file rule + ApplicationDbContextModelSnapshot updated + apply Dev+Design DB

BE CQRS (~584 LOC — Implementer Case 2):
- MeetingFeatures.cs 479 LOC 9 handler: 4 Room CRUD + 5 Booking (List + GetById +
  Create + Update + Cancel)
- SERIALIZABLE transaction overlap check via EXISTS query — throw 409 Conflict
  "Phòng đã được đặt trong khoảng thời gian này"
- MeetingRoomsController 49 LOC + MeetingBookingsController 56 LOC — class-level
  [Authorize] + Roles="Admin" for write
- Application.csproj +Microsoft.EntityFrameworkCore.Relational package (em main fix
  IsolationLevel overload — Implementer gotcha #53 4th truncation diagnose mid-task)
- MenuKeys.cs +4 const (Off_PhongHop sub-group + View/Manage/Book leaf)
- DbInitializer +SeedMeetingRoomsAsync 4 sample (PH-A Phòng họp lớn cap=20 + PH-B
  cap=8 + PHG-501 Giám đốc cap=6 + ONL-1 Online Zoom cap=50) — NOT gated DemoSeed
  per gotcha #51 INFRASTRUCTURE seed

FE 2 app (~1770 LOC × 2 — Implementer Case 2):
- types/meeting.ts × 2 SHA256 IDENTICAL (ce0ad9c6d017cde2) — DTO interface mirror
- MeetingCalendarPage.tsx × 2 SHA256 IDENTICAL (d6d160ae1e4f2285) ~530 LOC — custom
  HTML 7-day grid 8h-20h slot, NO FullCalendar dep (~80 KB bundle saved per
  Investigator verdict alternative)
- MeetingRoomsPage.tsx × 2 SHA256 IDENTICAL (ba35a7ef379a5e9c) ~270 LOC — admin
  catalog CRUD table + Dialog
- 4-place mirror Pattern 16-bis 7× cumulative: types + page + App.tsx route +
  menuKeys + Layout staticMap 3 entry (gotcha #50 silent sidebar drop prevention)

Verify:
- dotnet build SolutionErp.slnx PASS 0 error 2 pre-existing DocxRenderer warning
- dotnet test 130/130 PASS baseline preserve (58 Domain + 72 Infra)
- npm build × 2 app PASS 0 TS error (fe-admin 16.91s bundle 1490 KB / fe-user 8.56s
  bundle 1404 KB, +23 KB gzip both)

Pattern reinforced cumulative S36:
- Pattern 12-bis cross-module mirror 10× (PE → Contract V2 → Hrm → Office)
- Pattern 16-bis 4-place mirror cross-app 7×
- Smart Friend Implementer truncation gotcha #53 4th — mitigation tight brief WORK
  (FE 2 app no truncation, BE truncate diagnose mid only)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/SolutionErp.Api/Controllers/MeetingBookingsController.cs

@@ -0,0 +1,56 @@
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using SolutionErp.Application.Office;
+
+namespace SolutionErp.Api.Controllers;
+
+// Phase 10.2 G-O2 (S36) — Phòng họp Booking API.
+// Class-level [Authorize]: mọi user đăng nhập được book (multi-tenant office use case).
+// Authorization owner-or-admin enforced TRONG handler (UpdateMeetingBookingHandler +
+// CancelMeetingBookingHandler) — controller không restrict role.
+// Pattern 12-bis cross-module mirror HrmConfigsController.cs (S35 cumulative 10×).
+
+[ApiController]
+[Route("api/meeting-bookings")]
+[Authorize]
+public class MeetingBookingsController(IMediator mediator) : ControllerBase
+{
+    [HttpGet]
+    public async Task<List<MeetingBookingDto>> List(
+        [FromQuery] Guid? roomId,
+        [FromQuery] DateTime? startDate,
+        [FromQuery] DateTime? endDate,
+        [FromQuery] bool myOnly,
+        CancellationToken ct)
+        => await mediator.Send(new GetMeetingBookingsQuery(roomId, startDate, endDate, myOnly), ct);
+
+    [HttpGet("{id:guid}")]
+    public async Task<ActionResult<MeetingBookingDto>> GetById(Guid id, CancellationToken ct)
+    {
+        var dto = await mediator.Send(new GetMeetingBookingByIdQuery(id), ct);
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    [HttpPost]
+    public async Task<IActionResult> Create([FromBody] CreateMeetingBookingCommand body, CancellationToken ct)
+    {
+        var id = await mediator.Send(body, ct);
+        return CreatedAtAction(nameof(GetById), new { id }, new { id });
+    }
+
+    [HttpPut("{id:guid}")]
+    public async Task<IActionResult> Update(Guid id, [FromBody] UpdateMeetingBookingCommand body, CancellationToken ct)
+    {
+        if (id != body.Id) return BadRequest("Id mismatch");
+        await mediator.Send(body, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{id:guid}")]
+    public async Task<IActionResult> Cancel(Guid id, CancellationToken ct)
+    {
+        await mediator.Send(new CancelMeetingBookingCommand(id), ct);
+        return NoContent();
+    }
+}

src/Backend/SolutionErp.Api/Controllers/MeetingRoomsController.cs

@@ -0,0 +1,49 @@
+using MediatR;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using SolutionErp.Application.Office;
+
+namespace SolutionErp.Api.Controllers;
+
+// Phase 10.2 G-O2 (S36) — Phòng họp catalog API.
+// Class-level [Authorize]: mọi user đăng nhập được List (FE Booking page cần load room dropdown).
+// Per-action [Authorize(Roles = "Admin")] cho Create/Update/Delete: chỉ admin quản lý catalog.
+// Pattern 12-bis cross-module mirror HrmConfigsController.cs (S35 cumulative 10×).
+
+[ApiController]
+[Route("api/meeting-rooms")]
+[Authorize]
+public class MeetingRoomsController(IMediator mediator) : ControllerBase
+{
+    [HttpGet]
+    public async Task<List<MeetingRoomDto>> List(
+        [FromQuery] string? search,
+        [FromQuery] bool? isActiveOnly,
+        CancellationToken ct)
+        => await mediator.Send(new GetMeetingRoomsQuery(search, isActiveOnly), ct);
+
+    [HttpPost]
+    [Authorize(Roles = "Admin")]
+    public async Task<IActionResult> Create([FromBody] CreateMeetingRoomCommand body, CancellationToken ct)
+    {
+        var id = await mediator.Send(body, ct);
+        return CreatedAtAction(nameof(List), new { id }, new { id });
+    }
+
+    [HttpPut("{id:guid}")]
+    [Authorize(Roles = "Admin")]
+    public async Task<IActionResult> Update(Guid id, [FromBody] UpdateMeetingRoomCommand body, CancellationToken ct)
+    {
+        if (id != body.Id) return BadRequest("Id mismatch");
+        await mediator.Send(body, ct);
+        return NoContent();
+    }
+
+    [HttpDelete("{id:guid}")]
+    [Authorize(Roles = "Admin")]
+    public async Task<IActionResult> Delete(Guid id, CancellationToken ct)
+    {
+        await mediator.Send(new DeleteMeetingRoomCommand(id), ct);
+        return NoContent();
+    }
+}