feat(service): huỷ dịch vụ, SSL, đổi mật khẩu hosting, lịch sử thanh toán theo hình thức

- Lịch sử thanh toán hoá đơn trả thêm `method` (tự động gia hạn / số dư / admin / chuyển khoản / hoàn tiền), bỏ đuôi `(method)` khỏi ghi chú
- `DnsServer::panelUrl()` = https://<domain>/ dùng cho email cấp hosting và nút Plesk của khách
- Order item trả thêm `uuid`/`type` của dịch vụ để FE dẫn tới trang quản lý
- Yêu cầu huỷ dịch vụ, chứng chỉ SSL, lịch sử gia hạn, đổi mật khẩu hosting cho khách

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/Http/Resources/Api/Client/Service/ServiceClientDetailResource.php

@@ -3,31 +3,34 @@
 namespace App\Http\Resources\Api\Client\Service;
 
 use App\Models\DnsDomain;
+use App\Support\ResponseCipher;
+use App\Support\ServiceGroup;
 use App\Models\ModuleHostingPleskClient;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\Crypt;
 
 class ServiceClientDetailResource extends JsonResource
 {
-    public const MASKED_PASSWORD = '*****';
+    private const IRRELEVANT_KEYS = [
+        'hosting' => ['os', 'specs', 'vm', 'custom_product', 'ssl_certificate', 'dns_domain_id', 'dns_cancelled'],
+        'vps'     => ['hosting', 'service_plan', 'ssl_certificate', 'dns_domain_id', 'dns_cancelled'],
+        'cloud'   => ['hosting', 'service_plan', 'ssl_certificate', 'dns_domain_id', 'dns_cancelled'],
+        'domain'  => ['os', 'specs', 'vm', 'hosting', 'service_plan', 'custom_product', 'ssl_certificate'],
+        'ssl'     => ['os', 'specs', 'vm', 'hosting', 'service_plan', 'custom_product', 'dns_domain_id', 'dns_cancelled'],
+    ];
 
     /** Plesk panel login (persisted, reusable) — separate from the one-time FTP password, which is never stored. */
     private function resolvePleskCredentials($hosting): ?array
     {
-        $client = ModuleHostingPleskClient::query()
-            ->where('customer_id', $hosting->customer_id)
-            ->where('dns_manager_server_id', $hosting->dns_manager_server_id)
-            ->first();
+        $client = ModuleHostingPleskClient::forHosting($hosting);
 
         if (!$client) {
             return null;
         }
 
-        return [
-            'login'    => $client->login,
-            'password' => Crypt::decryptString($client->password),
-        ];
+        return ['login' => $client->login, 'password' => Crypt::decryptString($client->password)];
     }
 
     private function resolveDnsZone(): ?DnsDomain
@@ -101,9 +104,10 @@ class ServiceClientDetailResource extends JsonResource
         $dnsZone   = $this->resolveDnsZone();
         $dnsCancelled = $dnsZone !== null && (int) $dnsZone->is_created === DnsDomain::STATUS_CANCELLED;
 
-        return [
+        $payload = [
             'uuid'        => $this->uuid,
             'type'        => $this->type,
+            'group'       => ServiceGroup::of($this->orderItem?->product?->product_type ?? $this->product?->product_type, $this->orderItem?->product?->name ?? $this->product?->name),
             'server_name' => $this->server_name,
             'status'      => $this->status,
             'auto_renew'  => $this->auto_renew,
@@ -132,8 +136,8 @@ class ServiceClientDetailResource extends JsonResource
             'vm' => $vm ? [
                 'ip_address' => $vm->ipAddress?->ip ?? $vm->ip,
                 'hostname'   => $vm->hostname,
-                'username'   => $vm->user,
-                'password'   => $vm->plain_password ? self::MASKED_PASSWORD : null,
+                'username'   => ResponseCipher::encrypt($vm->user),
+                'password'   => ResponseCipher::encrypt($vm->plain_password),
                 'port'       => $vm->port,
                 'status'     => $vm->status,
                 'ip'         => $vm->ip ?? null,
@@ -141,17 +145,29 @@ class ServiceClientDetailResource extends JsonResource
             ] : null,
             'hosting' => $hosting ? [
                 'ip_address'   => $hosting->server?->publicHost(),
-                'plesk_url'    => $hosting->server
-                    ? "http://{$hosting->server->publicHost()}:{$hosting->server->panel_port}/"
-                    : null,
-                'hosting_plan' => $hosting->hosting_plan,
-                'ftp_username' => $hosting->ftp_username,
-                'username'     => $pleskCredentials['login'] ?? null,
-                'password'     => $pleskCredentials['password'] ?? null,
-                'status'       => $hosting->status,
+                'plesk_url'    => $hosting->server?->panelUrl(),
+                'username'     => ResponseCipher::encrypt($pleskCredentials['login'] ?? null),
+                'password'     => ResponseCipher::encrypt($pleskCredentials['password'] ?? null),
             ] : null,
+            'attachments' => \App\Models\ServiceAttachment::forCustomer()
+                ->where('service_id', $this->resource->id)
+                ->latest()
+                ->get()
+                ->map(fn ($file) => [
+                    'id'          => $file->id,
+                    'filename'    => $file->filename,
+                    'mime_type'   => $file->mime_type,
+                    'size'        => (int) $file->size,
+                    'uploaded_at' => $file->created_at?->toISOString(),
+                ])
+                ->values(),
+            'cancel_at_expiry' => (bool) $this->cancel_at_expiry,
+            'cancellation_request' => \App\Http\Controllers\Api\Client\Service\ServiceCancellationController::payload($this->resource->cancellationRequests()->pending()->latest()->first()),
+            'ssl_certificate' => $this->resource->sslCertificate?->data,
             'dns_domain_id' => $dnsZone && !$dnsCancelled ? $dnsZone->id : null,
             'dns_cancelled' => $dnsCancelled,
         ];
+
+        return Arr::except($payload, self::IRRELEVANT_KEYS[$this->type] ?? []);
     }
 }