feat(service): detach/attach service to customer with activity log

- Customer tab "delete" no longer deletes the service: it detaches the
  customer, discards the order/invoices and logs a `detached` activity
  with the previous customer and order.
- New POST customers/{uuid}/services/attach assigns an unassigned
  service (GET services?unassigned=1) to a customer, creating a pending
  order + unpaid invoice when missing, and logs `attached`.
- Detach/attach also sync module_vmware/module_hosting_accounts
  customer_id: ResolvesVm authorises by module_vmware.customer_id, so a
  detached customer could still control the VM.
- /services detach-customer (single + bulk) go through the same path.
- GET services/{id} returns the service activity logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/Api/Admin/Customer/DeleteCustomerServiceOrdersTest.php

@@ -45,7 +45,7 @@ class DeleteCustomerServiceOrdersTest extends TestCase
         return Service::where('server_name', $serverName)->firstOrFail();
     }
 
-    public function test_deleting_service_hides_its_order_and_invoices(): void
+    public function test_deleting_service_detaches_customer_and_hides_its_order_and_invoices(): void
     {
         $kept = $this->createService('kept.vn');
         $removed = $this->createService('removed.vn');
@@ -60,6 +60,54 @@ class DeleteCustomerServiceOrdersTest extends TestCase
         $this->assertSoftDeleted('invoices', ['order_id' => $removedOrderId]);
         $this->assertSame([$kept->orderItem->order_id], Order::pluck('id')->all());
         $this->assertSame(1, Invoice::count());
+
+        $removed->refresh();
+        $this->assertNull($removed->deleted_at);
+        $this->assertNull($removed->customer_id);
+        $this->assertNull($removed->order_item_id);
+
+        $log = $this->actingAs($this->admin, 'admin')
+            ->getJson("/api/v1/administrator/services/{$removed->id}")
+            ->assertOk()
+            ->json('data.activity_logs.0');
+        $this->assertSame('detached', $log['event']);
+        $this->assertSame($this->customer->email, $log['old_values']['customer_email']);
+        $this->assertSame($removedOrderId, $log['old_values']['order_id']);
+    }
+
+    public function test_detached_service_can_be_attached_to_another_customer(): void
+    {
+        $service = $this->createService('moved.vn');
+        $this->actingAs($this->admin, 'admin')->postJson(
+            "/api/v1/administrator/customers/{$this->customer->uuid}/services/bulk-delete",
+            ['ids' => [$service->id]],
+        )->assertOk();
+
+        $this->actingAs($this->admin, 'admin')
+            ->getJson('/api/v1/administrator/services?unassigned=1')
+            ->assertOk()
+            ->assertJsonPath('data.items.0.id', $service->id);
+
+        $other = Customer::factory()->create();
+        $this->actingAs($this->admin, 'admin')->postJson(
+            "/api/v1/administrator/customers/{$other->uuid}/services/attach",
+            ['service_id' => $service->id],
+        )->assertOk();
+
+        $service->refresh();
+        $this->assertSame($other->id, $service->customer_id);
+        $this->assertSame($other->id, $service->orderItem->order->customer_id);
+
+        $log = $this->actingAs($this->admin, 'admin')
+            ->getJson("/api/v1/administrator/services/{$service->id}")
+            ->json('data.activity_logs.0');
+        $this->assertSame('attached', $log['event']);
+        $this->assertSame($other->email, $log['new_values']['customer_email']);
+
+        $this->actingAs($this->admin, 'admin')->postJson(
+            "/api/v1/administrator/customers/{$this->customer->uuid}/services/attach",
+            ['service_id' => $service->id],
+        )->assertStatus(422);
     }
 
     public function test_recreating_same_service_discards_previous_order(): void