feat(admin): IP pool allocation, billing exports, service attachments

- IP pool: sheet import (xlsx/csv) matched by address, bulk allocate/revoke
  with notification email (ip_allocated/ip_revoked), ip_pool_logs history.
- Orders/invoices: Excel export on branded template (BrandedReportWriter),
  shared billing filters, order item service info in list responses.
- Web design quote Excel export; activity log export.
- Service attachments with copy-to-invoice; deployment invoice attachments.
- Customer email attachments stored on disk and attached by path.
- Admin password change endpoint; user.fullname backfill migration;
  orders.user_id backfill from logs.
- Disable deploy workflow until CI/CD is set up.
- Ignore stored customer email and service attachment uploads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/Api/Admin/Auth/AuthController.php

@@ -4,11 +4,13 @@ namespace App\Http\Controllers\Api\Admin\Auth;
 
 use App\Http\Controllers\Controller;
 use App\Http\Requests\UpdateProfileRequest;
+use App\Http\Requests\UpdateAdminPasswordRequest;
 use App\Http\Resources\Api\Admin\AdminUserResource;
 use App\Services\ActivityLogger;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\RateLimiter;
 use Tymon\JWTAuth\Facades\JWTAuth;
 use Tymon\JWTAuth\Exceptions\JWTException;
@@ -93,6 +95,27 @@ class AuthController extends Controller
         ]);
     }
 
+    public function updatePassword(UpdateAdminPasswordRequest $request): JsonResponse
+    {
+        $user = Auth::guard('admin')->user();
+
+        $user->update([
+            'password' => Hash::make($request->string('password')->toString()),
+        ]);
+
+        $this->activityLogger->logAuth(
+            'password_changed',
+            'admin',
+            $user->id,
+            $user->username ?? $user->email,
+        );
+
+        return response()->json([
+            'error'   => false,
+            'message' => 'Đổi mật khẩu thành công.',
+        ]);
+    }
+
     public function refresh(): JsonResponse
     {
         try {