feat(clients): dual-OTP verified contact changes with customer notification

Mobile number and email address changes now require OTP verification on
both the old and new destination (staff-entered) before the update is
accepted, at both client creation and edit time — closing a gap where an
unverified wrong number/email could never be corrected later. Every
mobile/email/address change also emails the customer at their pre-change
address so an unauthorized change is never silent.

- New ClientContactOtpService (+Impl) mirrors the existing login OTP
  services, reusing OtpLog with a CLIENT_CONTACT_CHANGE purpose.
- New sibling API resources for edit (/clients/{id}/contact-verification/otp)
  and create (/clients/contact-verification/otp, no clientId yet).
- ClientWritePlatformServiceJpaRepositoryImpl / AddressWritePlatformServiceImpl
  gate the actual field change on verified OTPs and fire
  ClientChangeNotificationService afterwards; the notification recipient is
  always snapshotted before any mutation so a same-request mobile+email
  change can't accidentally alert the new (unverified-by-its-real-owner)
  address instead of the old one.
- ClientDataValidator validates OTP id format only (ignoreIfNull) —
  enforcement lives solely in the write-service's diff-gated calls, since
  edit-client always PUTs the full client object regardless of what changed.
- 0420 migration seeds 8 CLIENTKYC action permissions
  (GenerateAadhaarOtp/VerifyAadhaar/VerifyPan/VerifyCin/VerifyDin/
  VerifyGstin/UploadCkyc/CompleteRekyc) that were referenced by existing
  command handlers but never seeded, causing a 404 for every user including
  Super User.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-core/src/main/java/org/apache/fineract/portfolio/client/api/ClientApiConstants.java

@@ -96,6 +96,15 @@ public class ClientApiConstants {
     public static final String mobileNoParamName = "mobileNo";
     public static final String alternateMobileNoParamName = "alternateMobileNo";
     public static final String emailAddressParamName = "emailAddress";
+    // Dual-OTP contact-change verification (see ClientContactOtpService) — required only when
+    // mobileNo or emailAddress is being changed via PUT /clients/{id}. Reference an already
+    // VERIFIED m_otp_log row for the OLD destination (current DB value) and the NEW destination
+    // (incoming value) respectively. Field-specific (not a single generic pair) so mobileNo and
+    // emailAddress can both change in the same request without ambiguity.
+    public static final String mobileOldOtpIdParamName = "mobileOldOtpId";
+    public static final String mobileNewOtpIdParamName = "mobileNewOtpId";
+    public static final String emailOldOtpIdParamName = "emailOldOtpId";
+    public static final String emailNewOtpIdParamName = "emailNewOtpId";
     public static final String firstnameParamName = "firstname";
     public static final String middlenameParamName = "middlename";
     public static final String lastnameParamName = "lastname";