feat(admin): IP pool allocation, billing exports, service attachments

- IP pool: sheet import (xlsx/csv) matched by address, bulk allocate/revoke
  with notification email (ip_allocated/ip_revoked), ip_pool_logs history.
- Orders/invoices: Excel export on branded template (BrandedReportWriter),
  shared billing filters, order item service info in list responses.
- Web design quote Excel export; activity log export.
- Service attachments with copy-to-invoice; deployment invoice attachments.
- Customer email attachments stored on disk and attached by path.
- Admin password change endpoint; user.fullname backfill migration;
  orders.user_id backfill from logs.
- Disable deploy workflow until CI/CD is set up.
- Ignore stored customer email and service attachment uploads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

routes/api/admin/auth.php

@@ -13,6 +13,8 @@ Route::get('me', [AuthController::class, 'me']);
 
 Route::put('profile', [AuthController::class, 'updateProfile']);
 
+Route::put('password', [AuthController::class, 'updatePassword']);
+
 // Role Permissions
 Route::prefix('role-permissions')->group(function () {
     // Accessible bởi mọi admin — trả về permissions hiệu lực của user hiện tại

routes/api/admin/billing.php

@@ -13,6 +13,7 @@ Route::prefix('orders')
     ->controller(OrderController::class)
     ->group(function () {
         Route::get('/', 'index')->middleware('perm:order.view');
+        Route::get('export', 'export')->middleware('perm:order.view');
         Route::get('/domain-pricing', 'domainPricing')->middleware('perm:order.create');
         Route::post('/upload-proof', 'uploadProof')->middleware('perm:order.create');
         Route::post('/', 'store')->middleware('perm:order.create');
@@ -28,6 +29,7 @@ Route::prefix('invoices')
     ->controller(InvoiceController::class)
     ->group(function () {
         Route::get('/', 'index')->middleware('perm:invoice.view');
+        Route::get('export', 'export')->middleware('perm:invoice.view');
         Route::post('/', 'store')->middleware('perm:invoice.create');
         Route::get('{id}', 'show')->middleware('perm:invoice.view');
         Route::put('{id}', 'update')->middleware('perm:invoice.edit');

routes/api/admin/catalog.php

@@ -97,5 +97,6 @@ Route::prefix('web-design-quotes')
         Route::put('{id}', 'update')->middleware('perm:order.edit');
         Route::patch('{id}/status', 'updateStatus')->middleware('perm:order.edit');
         Route::get('{id}/pdf', 'downloadPdf')->middleware('perm:order.view');
+        Route::get('{id}/xlsx', 'downloadXlsx')->middleware('perm:order.view');
         Route::delete('{id}', 'destroy')->middleware('perm:order.destroy');
     });

routes/api/admin/customers.php

@@ -89,4 +89,8 @@ Route::prefix('services')->controller(ServiceController::class)->group(function
     Route::get('{id}', 'show')->middleware('perm:customer.view');
     Route::patch('{id}/detach-customer', 'detachCustomer')->middleware('perm:customer.edit');
     Route::post('{id}/resend-credentials', 'resendCredentials')->middleware('perm:customer.edit');
+    Route::get('{id}/attachments', 'listAttachments')->middleware('perm:customer.view');
+    Route::post('{id}/attachments', 'uploadAttachment')->middleware('perm:customer.edit');
+    Route::delete('{id}/attachments/{attachmentId}', 'deleteAttachment')->middleware('perm:customer.edit');
+    Route::post('{id}/attachments/{attachmentId}/copy-to-invoice', 'copyAttachmentToInvoice')->middleware('perm:invoice.edit');
 });

routes/api/admin/infrastructure.php

@@ -106,9 +106,15 @@ Route::prefix('ip-pool')
         Route::get('/', 'index')->middleware('perm:module-vcenter.view');
         Route::post('/', 'store')->middleware('perm:module-vcenter.manager');
         Route::post('sync', 'sync')->middleware('perm:module-vcenter.manager');
+        Route::post('import/preview', 'importPreview')->middleware('perm:module-vcenter.manager');
         Route::post('import', 'import')->middleware('perm:module-vcenter.manager');
         Route::delete('bulk', 'bulkDelete')->middleware('perm:module-vcenter.manager');
         Route::post('bulk-update-gateway', 'bulkUpdateGateway')->middleware('perm:module-vcenter.manager');
+        Route::post('allocation/preview', 'allocationPreview')->middleware('perm:module-vcenter.manager');
+        Route::post('allocate', 'allocate')->middleware('perm:module-vcenter.manager');
+        Route::post('revocation/preview', 'revocationPreview')->middleware('perm:module-vcenter.manager');
+        Route::post('revoke', 'revoke')->middleware('perm:module-vcenter.manager');
+        Route::get('{id}/logs', 'logs')->middleware('perm:module-vcenter.view');
         Route::get('{id}', 'show')->middleware('perm:module-vcenter.view');
         Route::put('{id}', 'update')->middleware('perm:module-vcenter.manager');
         Route::delete('{id}', 'destroy')->middleware('perm:module-vcenter.manager');

routes/api/admin/system.php

@@ -140,8 +140,10 @@ Route::prefix('activity-logs')
     ->middleware('perm:system-log.manager')
     ->group(function () {
         Route::get('/', 'index');
+        Route::get('export', 'export');
         Route::get('modules', 'modules');
         Route::get('stats', 'stats');
+        Route::delete('/', 'destroy');
         Route::get('{id}', 'show');
     });