feat(working-capital): manage breach, near-breach, delinquency actions and originators

[Aman-Mittal]

Closes #396, #397, #398, #399, #400, #401. Completes the epic in #395.

Description

A Working Capital loan was read-only in this UI. Four capabilities the backend already exposes — delinquency actions, breach actions, near-breach actions, and per-loan loan-originator attach/detach — had no entry point, so recording a breach action meant leaving the back office and calling Fineract directly.

The main change adds those four write paths. Working through them surfaced several defects and coverage gaps in the same neighbourhood, which are included here rather than deferred; each is filed as its own sub-issue so it can be judged on its own terms.

Working Capital actions (#396)

• Three new tabs on wc-loan-view: breach actions, near-breach actions, originators.
• Three new action-form components, each on its own lazily-loaded route guarded by UPDATE_WORKINGCAPITALLOAN, plus a "New Action" affordance on the existing delinquency actions tab.
• Originators can be attached to and detached from a loan directly.
• New WC_LOANS.* translation keys; hi and ko carry the new keys with the same coverage gap as the rest of those files (Hindi and Korean are 18% translated, so both languages render mostly in English #255).

API client sync and the interop call it breaks (#397)

public/api/fineract.json re-synced against apache/fineract:latest (1472 → 1475 schemas), with provenance updated to the new digest. The sync gives POST /interoperation/transactions/{accountId}/loanrepayment a request body where it previously took none — every field optional, so the existing bodyless call still compiled while sending nothing. It now sends dateFormat and locale, matching every other Fineract command on that screen.

Dashboard tour highlighted the wrong element (#398)

The tour's second step used targetSelector: 'ul', which resolves to the first <ul> in the document — the sidebar's nav-list, not the System Status card its copy describes. Now targets .status-list. The tour's own Exit/Back/Next/Finish buttons were hardcoded English and now resolve through COMMON.*.

Global search swallowed result clicks (#399)

Results were hidden by a 150 ms blur timeout that the click had to beat. Under a slow render the timeout won, the list collapsed, and the click landed on nothing — no navigation, no error. Result items now preventDefault() on mousedown so the searchbar never blurs for a result click; the timeout remains as a fallback for Escape and click-outside.

RBAC coverage (#400)

rbac-multi-permission.spec.ts covers four dimensions rbac-backend-restricted-user.spec.ts does not reach: OR semantics on multi-permission routes, ALL_FUNCTIONS_READ against Fineract's real permission catalogue rather than a mocked session, a second action-level gate, and whether a restricted session survives a page reload rather than only a fresh login. Follows the existing spec's shape — every refusal asserted both as "router sent them to Access Denied" and as "Fineract returned 403", since the guard is defence-in-depth and showing only the client half invites the wrong conclusion.

Demo data seeding (#401)

npm run seed:demo-data populates a fresh backend with a representative dataset — office, staff, centre, group, an active loan, a loan pending approval, savings, a fixed deposit, a share account, a journal entry, reports — and prints what it created. Composed entirely from existing seed-api.ts helpers, so there is no second seeding implementation to keep in step.

It is its own Playwright project (demo-seed) rather than a member of or dependency of BACKEND_SPECS: nothing in it asserts anything, so it must never run as a side effect of --project=backend in CI. It also does not depend on the setup project, so it works against a backend nothing else has touched.

Checklist

• npm run lint clean
• npm run format:check clean
• npm run i18n:check — no missing keys
• npm run check:route-permissions — 309 screens, 119 nav entries, guard order and visibility agree
• npm run typecheck:e2e clean
• npm run check:licenses — no Category X or unclassified licences
• Unit tests accompany each new component
• Commit is GPG-signed
• Linked to issues in this repository

Testing notes

The Working Capital endpoints are Fineract 1.15.0+ and not reachable on the public community sandbox, so working-capital-loan-actions.spec.ts mocks them. rbac-multi-permission.spec.ts needs a real backend and is registered in BACKEND_SPECS.

[Aman-Mittal]

Superseded by #408.

That branch is this one rebased, with a second commit adding a Vitest runner and a CI ratchet for the deprecated Karma suite. The working-capital commit here is unchanged and carried over intact, so nothing from this PR is lost — it is the first of the two commits on #408, and closes the same issues (#396–#401).

Closing this to keep one branch under review rather than two overlapping ones.