[CLAUDE] Phase4: Report MVP + Docs Consolidation (rules, architecture, schema-diagram)

Backend Report:
- Application/Reports/Dtos/DashboardStatsDto: 5 KPI + PhaseCount + SupplierCount + ProjectCount + MonthlyValue
- Application/Reports/Queries/GetDashboardStats handler: total/active/overdue/published this month/totalValueActive + byPhase + top 5 NCC/du an + 12 thang monthly (fill zero khi thang empty)
- Application/Reports/Services/IContractExcelExporter interface
- Infrastructure/Reports/ContractExcelExporter: ClosedXML workbook 10 cot, header style bold+blue, number format #,##0, formula SUM, auto-fit, freeze header
- Application/Reports/Commands/ExportContractsToExcelCommand: filter phase/supplier/project/date range
- Api/Controllers/ReportsController: GET /reports/dashboard, GET /reports/contracts/export
- DI register IContractExcelExporter (Scoped)

Frontend fe-admin:
- types/reports.ts: DashboardStats type
- components/BarChart.tsx: generic horizontal bar chart — chi Tailwind, khong thu vien ngoai
- pages/DashboardPage.tsx REWRITE: 5 KPI card (FileText/TrendingUp/AlertTriangle/CheckCircle2/Coins) + by-phase bar + monthly 12-month chart + top 5 NCC + top 5 du an + skeleton loader
- pages/ReportsPage.tsx MOI: filter phase/fromDate/toDate → export Excel button
- Route /reports vao App.tsx

E2E verified:
- GET /api/reports/dashboard → 200 voi day du KPI + monthly fill 12 thang
- GET /api/reports/contracts/export → 200 xlsx 7229 bytes (Microsoft Excel 2007+)

Docs consolidation (theo yeu cau user):
- docs/rules.md MOI: 9 section coding conventions (ngon ngu UI/code/DB/docs, BE Clean Arch, CQRS+MediatR, Validation FluentValidation, Error handling, Async, Entity rules, DI, Package pinning, FE React/TS erasableSyntaxOnly, path alias, TanStack Query, Permission guard, Toast+error, DB convention, Git commit format, Docs structure, Testing, Security)
- docs/architecture.md MOI: layered overview ASCII art, request lifecycle (1 POST/api/contracts qua 10 step), workflow state machine 9 phase, permission model, data flow sequence diagram 4 actor (Drafter/Manager/CCM/BOD/HRA), deployment architecture Phase 5, skill library, non-functional table
- docs/database/schema-diagram.md MOI: full ERD 19 table mermaid + data flow diagram + vong doi 1 HD (create → 7 transition → gen ma → publish) + index strategy table + relationship cardinality + soft delete behavior + SQL queries (inbox/dashboard/gen ma) + migration history
- docs/gotchas.md UPDATE: 17 → 26 pitfalls, them section "Claude Code harness quirks" (Edit File not read, DI build pass nhung runtime fail) + "Contract workflow" (ma HD gen 2 lan, BE-FE NEXT_PHASES sync, race condition) + "Permission matrix" (cache real-time, MenuKey typo)
- docs/STATUS.md: Phase 4 MVP done, docs entry points section liet ke het, next Phase 5 Production
- docs/HANDOFF.md: phase table them Phase 4 row, file tree update voi Reports, test points day du, git state commit 7
- docs/changelog/migration-todos.md: tick Phase 4 MVP items + them iteration 2 list
- docs/changelog/sessions/2026-04-21-1430-phase4-report.md: session log voi thong so cumulative (BE 3100 LOC, 30 docs)
- CLAUDE.md root: update Tai lieu quan trong section them rules.md, architecture.md, schema-diagram.md, .claude/skills (13 links now)

Bug fix:
- TS unused import ContractPhaseLabel trong DashboardPage
- DI thieu register IContractExcelExporter — build pass but runtime would fail (added)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/STATUS.md

@@ -2,9 +2,9 @@
 
 > **Update rule:** trước khi bắt đầu 1 task → ghi row vào `🔥 In Progress`. Xong → chuyển sang `✅ Recently Done`.
 
-**Last updated:** 2026-04-21 13:30
+**Last updated:** 2026-04-21 14:30
 
-## 📍 Phase hiện tại: **Phase 3 Workflow (MVP xong)** — sẵn sàng Phase 4 Report hoặc polish Phase 3 iteration 2
+## 📍 Phase hiện tại: **Phase 4 Report MVP (xong)** — sẵn sàng Phase 5 Production hoặc polish iterations
 
 ## 🔥 In Progress
 
@@ -14,72 +14,73 @@ _(không có)_
 
 | Ngày | Ai | Task | Commit |
 |---|---|---|---|
-| 2026-04-21 | Claude | **Phase 3 Workflow MVP** — Contract+Approval+Comment+Attachment+CodeSequence entities + IContractWorkflowService (9 phase adjacency + role guard + bypass CĐT) + IContractCodeGenerator (RG-001 transactional) + CQRS 8 command/query + ContractsController. FE: fe-admin ContractsList + ContractDetail, fe-user Inbox+Create+Detail+MyContracts. **E2E 9 phase end-to-end pass với mã HĐ `FLOCK 01/HĐGK/SOL&PVL2026/01`** | (sắp commit) |
-| 2026-04-21 | Claude | **Phase 2 Form Engine MVP** — OpenXml + ClosedXML renderer + seed 8 template + FE FormsPage | `5113e4c` |
-| 2026-04-21 | Claude | **Phase 1.2** — CRUD Master + Permission Matrix + FE 4 page | `54d6c9b` |
-| 2026-04-21 | Claude | **Docs + flows** | `49a5f57` |
-| 2026-04-21 | Claude | **Phase 1 foundation** — Clean Arch + Identity + JWT + 2 FE + login E2E | `702411f` |
+| 2026-04-21 | Claude | **Phase 4 Report MVP + Docs Consolidation** — BE Dashboard stats (5 KPI + by phase + top 5 NCC/dự án + 12 tháng) + Excel export qua ClosedXML. FE DashboardPage rewrite với BarChart tự build (không thư viện ngoài) + ReportsPage filter export. Docs: rules.md (coding conventions), architecture.md (layered + sequence), database/schema-diagram.md (ERD + data flow 19 table), gotchas.md update 26 pitfalls | (sắp commit) |
+| 2026-04-21 | Claude | **Phase 3 Workflow MVP** — 9 phase state machine + code gen RG-001 + Inbox/Detail FE — E2E pass mã `FLOCK 01/HĐGK/SOL&PVL2026/01` | `7e957a7` |
+| 2026-04-21 | Claude | **Phase 2 Form Engine MVP** | `5113e4c` |
+| 2026-04-21 | Claude | **Phase 1.2** — CRUD Master + Permission Matrix | `54d6c9b` |
+| 2026-04-21 | Claude | **Docs addition** — database-guide + flows | `49a5f57` |
+| 2026-04-21 | Claude | **Phase 1 foundation** — Clean Arch + Identity + JWT + 2 FE | `702411f` |
 | 2026-04-21 | Claude | **Phase 0** — scaffold + docs | `25dad7f` |
 
-Session logs: [Phase 0](changelog/sessions/2026-04-21-1045-phase0-scaffold.md) · [Phase 1f](changelog/sessions/2026-04-21-1100-phase1-foundation.md) · [Phase 1.2](changelog/sessions/2026-04-21-1130-phase1-cruds-permission.md) · [Phase 2](changelog/sessions/2026-04-21-1200-phase2-form-engine.md) · [Phase 3](changelog/sessions/2026-04-21-1330-phase3-workflow.md)
+Session logs: [P0](changelog/sessions/2026-04-21-1045-phase0-scaffold.md) · [P1f](changelog/sessions/2026-04-21-1100-phase1-foundation.md) · [P1.2](changelog/sessions/2026-04-21-1130-phase1-cruds-permission.md) · [P2](changelog/sessions/2026-04-21-1200-phase2-form-engine.md) · [P3](changelog/sessions/2026-04-21-1330-phase3-workflow.md) · [P4](changelog/sessions/2026-04-21-1430-phase4-report.md)
 
-Gotchas: [`gotchas.md`](gotchas.md) · Handoff: [`HANDOFF.md`](HANDOFF.md)
+**Docs entry points:**
+- [`rules.md`](rules.md) — coding conventions
+- [`architecture.md`](architecture.md) — layered + data flow + deployment
+- [`database/database-guide.md`](database/database-guide.md) + [`database/schema-diagram.md`](database/schema-diagram.md) — DB spec
+- [`gotchas.md`](gotchas.md) — 26 pitfalls
+- [`HANDOFF.md`](HANDOFF.md) — brief 5 phút
+- [`workflow-contract.md`](workflow-contract.md) — state machine
+- [`forms-spec.md`](forms-spec.md) — 8 form catalog
+- [`flows/`](flows/) — 6 flow diagram
 
 ## 🎯 Next up
 
-### Phase 3 iteration 2 (polish — optional)
+### Phase 5 — Production (T12-13, item lớn nhất còn lại)
 
-- [ ] `SlaExpiryJob` BackgroundService auto-approve quá hạn
-- [ ] Email notification (MailKit) khi chuyển phase
-- [ ] In-app notification (SignalR + badge)
-- [ ] Upload attachment endpoint + FE multipart
-- [ ] RowVersion optimistic concurrency
-- [ ] Render HĐ docx khi tạo (merge ContractClause appendix)
+- [ ] CI/CD Gitea Actions (`.gitea/workflows/deploy.yml`) deploy IIS
+- [ ] `scripts/deploy-iis.ps1` stop app pool → xcopy → start
+- [ ] Windows Server setup: IIS + URL Rewrite + ARR
+- [ ] HTTPS cert via win-acme
+- [ ] `appsettings.Production.json` + user secrets
+- [ ] Rate limiting middleware
+- [ ] Security audit OWASP top 10
+- [ ] Health check endpoint `/health`
+- [ ] Serilog → file rolling daily retention 30d
+- [ ] Runbook: restart, rollback, backup/restore
+- [ ] UAT production 1 tuần
 
-### Phase 4 — Report + Polish (tuần 10-11)
+### Polish iterations (optional — làm khi rảnh)
 
-- [ ] Dashboard admin: HĐ theo phase / top NCC / top dự án / tổng giá trị tháng
-- [ ] Excel export list HĐ (EPPlus/ClosedXML)
-- [ ] Report quá hạn SLA theo phase/role
-- [ ] UX polish: skeleton, empty state, error boundary
-- [ ] Accessibility pass
-- [ ] Index DB hot query
-- [ ] User guide docs
-- [ ] UAT với data thật
+**Phase 2 iter 2:** convert 3 .doc, field spec JSON + form builder, {{#loop}}, PDF convert, upload template UI
+**Phase 3 iter 2:** SLA auto-approve job, email/in-app notification, attachment upload, RowVersion, render HĐ khi tạo
+**Phase 4 iter 2:** SLA overdue report, PDF HĐ export, dashboard user-specific
 
-### Phase 5 — Production (tuần 12-13)
+### Quick wins
 
-- [ ] CI/CD Gitea Actions → IIS deploy
-- [ ] HTTPS cert + appsettings Production secrets
-- [ ] Rate limiting + Security audit
-- [ ] Backup/restore runbook
-
-### Quick wins (không block)
-
-- [ ] FE Users management + Roles CRUD
-- [ ] Filter Inbox theo phase FE
-- [ ] Refresh token auto (FE axios interceptor)
+- FE Users management + Roles CRUD (test permission non-admin)
+- Filter Inbox theo phase FE
+- FE refresh token auto interceptor
 
 ## 📊 Thông số cumulative
 
-| | Phase 0 | 1f | 1.2 | 2 | **Phase 3 MVP** |
-|---|---:|---:|---:|---:|---:|
-| BE LOC | 0 | ~400 | ~1500 | ~1900 | **~2700** |
-| DB tables | 0 | 7 | 12 | 14 | **19** |
-| API endpoints | 0 | 4 | ~20 | ~23 | **~31** |
-| Migrations | 0 | 1 | 3 | 4 | **5** |
-| FE pages | 0 | 2 | 6 | 7 | **14** (9 admin + 5 user) |
-| Docs | 10 | 13 | 14 | 24 | **26** |
-| Commits | 1 | 2 | 3 | 5 | **6** (sắp) |
+| | P0 | P1f | P1.2 | P2 | P3 | **P4** |
+|---|---:|---:|---:|---:|---:|---:|
+| BE LOC | 0 | ~400 | ~1500 | ~1900 | ~2700 | **~3100** |
+| DB tables | 0 | 7 | 12 | 14 | 19 | **19** |
+| API endpoints | 0 | 4 | ~20 | ~23 | ~31 | **~33** |
+| FE pages | 0 | 2 | 6 | 7 | 14 | **16** |
+| Docs | 10 | 13 | 14 | 24 | 26 | **30** |
+| Commits | 1 | 2 | 3 | 5 | 6 | **7** (sắp) |
 
 ## 🚨 Blockers / risks
 
-- ⏳ **Gitea remote URL** — vẫn chờ
-- ⚠️ **SLA hiện chỉ set deadline** — không có job auto-approve (Phase 3.2)
-- ⚠️ **Không có notification** (email/in-app) — user phải F5 inbox manual
-- ⚠️ **Không có RowVersion** — 2 user cùng transition race → last-write-wins
+- ⏳ **Gitea remote URL** — user sẽ cấp khi vào Phase 5
 - ⚠️ **3 file .doc chưa convert** (Phase 2 carryover)
-- ⚠️ **Permission chưa test với non-admin user** — tất cả E2E đều dùng admin
+- ⚠️ **SLA chỉ set deadline** — không auto-approve (Phase 3.2)
+- ⚠️ **Không notification** email/in-app (Phase 3.2)
+- ⚠️ **Permission chưa test non-admin user thật** — cần FE Users mgmt
+- ⚠️ **FE refresh token** — 401 chỉ redirect logout, chưa auto-refresh
 
 ## Credentials + URLs
 
@@ -88,5 +89,5 @@ admin@solutionerp.local / Admin@123456
 ```
 
 - API: http://localhost:5443 — Swagger `/swagger`
-- Admin FE: http://localhost:8082
-- User FE: http://localhost:8080
+- Admin FE: http://localhost:8082 — Dashboard → **`/dashboard`** (KPI mới), **`/contracts`** (list), **`/reports`** (export), **`/master/*`** (NCC/DA/PB), **`/forms`**, **`/system/permissions`**
+- User FE: http://localhost:8080 — Inbox → **`/inbox`**, **`/contracts/new`**, **`/my-contracts`**