feat(working-capital): loan servicing actions, plus a Vitest runner and a Karma ratchet

[Aman-Mittal]

Supersedes and closes #402, which contained the first commit only. Rebased and combined so there is one branch to review and merge.

Closes #396, closes #397, closes #398, closes #399, closes #400, closes #401 — the working-capital epic #395.
Closes #403 — the test-runner epic. Its sub-issues #404, #405, #406, #407, #409, #410 and #411 are the follow-up batches this enables, and stay open.

Commit 1 — Working Capital loan servicing

A Working Capital loan was read-only in this UI. Four capabilities the backend already exposes — delinquency actions, breach actions, near-breach actions, and per-loan loan-originator attach/detach — had no entry point, so recording a breach action meant leaving the back office and calling Fineract directly.

• Three new tabs on wc-loan-view, three new action forms, each on a lazily-loaded route guarded by UPDATE_WORKINGCAPITALLOAN (A Working Capital loan is read-only: delinquency, breach and near-breach actions and originators cannot be recorded #396).
• API client re-synced against apache/fineract:latest (1472 → 1475 schemas). The sync gives the interop loan-repayment command a request body it previously had none of — every field optional, so the bodyless call still compiled while sending nothing. It now sends dateFormat and locale (Interop loan repayment is sent with no request body after the API spec adds one #397).
• The dashboard tour's second step used targetSelector: 'ul', which resolves to the first <ul> in the document — the sidebar's nav list, not the System Status card its copy describes. Now targets .status-list, and the tour's own buttons are translated (The dashboard guidance tour highlights the sidebar instead of the System Status card it is describing #398).
• Global search hid results behind a 150 ms blur timeout the click had to beat; under a slow render the timeout won and the click landed on nothing. Result items now preventDefault() on mousedown (Clicking a global search result can do nothing — the blur timeout races the click and wins #399).
• New RBAC spec covering multi-permission routes, ALL_FUNCTIONS_READ against Fineract's real catalogue, a second action-level gate, and reload persistence (RBAC e2e never covers multi-permission routes, ALL_FUNCTIONS_READ, or whether a restricted session survives a reload #400).
• npm run seed:demo-data populates a fresh backend with a representative dataset, as its own demo-seed Playwright project so it never runs as a side effect of --project=backend (No repeatable way to populate a backend with demo data, so manual and release-candidate testing starts from an empty tenant #401).

Commit 2 — Vitest runner and Karma ratchet

Karma is deprecated and @angular/build:karma goes with it. vitest@4 was already in devDependencies with nothing wired to it — two runners carried, only the deprecated one used.

219 specs and 886 jasmine.* sites cannot move in one commit, so this makes the suite movable in batches and stops it growing in the meantime:

• The runners select by filename. *.spec.ts is Karma (legacy, shrinking), *.test.ts is Vitest (everything new). A migration is a rename plus a dialect swap.
• scripts/check-test-runner.mjs records the remaining Karma specs in karma-baseline.json and fails CI when the set grows — the same ratchet as eslint-suppressions.json. --write refuses to record a baseline that grew, so the ratchet cannot be released by the command that documents it.
• scripts/codemod-jasmine-to-vitest.mjs does the dialect and the rename, converting 187 of 215. It skips whole files using fakeAsync/tick/flush, done() callbacks or the object form of createSpyObj — those carry semantics, not spelling, and a half-converted spec that still compiles reads as finished in review.
• src/app/testing/mocks.ts provides SpyObj<T>/createSpyObj<T>(), reproducing Jasmine's typing including its unsoundness, so the migration is not also a strict-null audit of 358 annotations.

Two environment differences had to be solved before any Ionic spec could run at all:

• @ionic/angular reaches @ionic/core/components as a directory import, which Node's ESM resolver rejects. Karma's bundler resolved it; Vitest externalises the package and hands it to Node. vitest.config.ts inlines it.
• jsdom has no CSS.escape, no Element.prototype.scrollTo (Ionic's ion-segment scrolls the active button into view during change detection) and no usable matchMedia. Stubbed in src/testing/vitest-setup.ts, each with a comment saying what it does not do.

30 specs migrated. Karma 921 + Vitest 270 = 1191 — the same total as before the split, so nothing was lost in the move.

Interaction with other open PRs — checked

• No file-level conflicts. None of the 9 spec files touched by open PRs (fix(dialogs): replace native loan and client confirmations #394, feat(clients): add empty-state actions on account tabs #392, fix: reject maker-checker tasks without deleting audit entries #325, fix: show domain rule errors for 403 responses #260) is one this branch renamed.
• fix: reject maker-checker tasks without deleting audit entries #325 adds a new .spec.ts, which the ratchet would otherwise fail. It predates this rule, so it is listed under grandfathered in karma-baseline.json and admitted. Kept in a separate key from specs so the exception stays visible and finite, and so --write cannot quietly reclassify it.
• chore(deps): bump @ngx-translate/core from 17.0.0 to 18.0.0 #207 (ngx-translate 18) touches package.json; this branch adds two scripts there. Textual, trivial to resolve.

Checklist

• npm run lint clean — eslint-suppressions.json regenerated after the renames; 443 across 400 files, unchanged from main, so violations followed the renames without any added or lost
• npm run format:check clean
• npm run check:test-runner passes (192 remaining, 14% migrated)
• npm run i18n:check, check:route-permissions, typecheck:e2e, check:licenses, check-license.sh all clean
• npm test -- --watch=false — 921 pass
• npm run test:unit — 270 pass across 30 files, including Ionic component rendering
• Both commits GPG-signed

Reviewer notes

@angular/build:unit-test is marked [EXPERIMENTAL] upstream. It is nonetheless Angular's sanctioned path off Karma, and the alternative is staying on something already deprecated — that trade, and the open question about whether to move to Vitest browser mode instead of stubbing jsdom, are both written up in DOCS/adr/0004-vitest-migration.md.

The e2e suites were not run locally; they need the Docker Fineract stack. CI covers them.