feat(clients): dual-OTP verified contact changes with customer notification

Mobile number and email address changes now require OTP verification on
both the old and new destination (staff-entered) before the update is
accepted, at both client creation and edit time — closing a gap where an
unverified wrong number/email could never be corrected later. Every
mobile/email/address change also emails the customer at their pre-change
address so an unauthorized change is never silent.

- New ClientContactOtpService (+Impl) mirrors the existing login OTP
  services, reusing OtpLog with a CLIENT_CONTACT_CHANGE purpose.
- New sibling API resources for edit (/clients/{id}/contact-verification/otp)
  and create (/clients/contact-verification/otp, no clientId yet).
- ClientWritePlatformServiceJpaRepositoryImpl / AddressWritePlatformServiceImpl
  gate the actual field change on verified OTPs and fire
  ClientChangeNotificationService afterwards; the notification recipient is
  always snapshotted before any mutation so a same-request mobile+email
  change can't accidentally alert the new (unverified-by-its-real-owner)
  address instead of the old one.
- ClientDataValidator validates OTP id format only (ignoreIfNull) —
  enforcement lives solely in the write-service's diff-gated calls, since
  edit-client always PUTs the full client object regardless of what changed.
- 0420 migration seeds 8 CLIENTKYC action permissions
  (GenerateAadhaarOtp/VerifyAadhaar/VerifyPan/VerifyCin/VerifyDin/
  VerifyGstin/UploadCkyc/CompleteRekyc) that were referenced by existing
  command handlers but never seeded, causing a 404 for every user including
  Super User.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -440,6 +440,7 @@
     <include file="parts/0417_add_first_login_gate_config.xml" relativeToChangelogFile="true"/>
     <include file="parts/0418_add_user_agreement_permissions.xml" relativeToChangelogFile="true"/>
     <include file="parts/0419_revert_first_login_gate_column_and_config.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0420_add_missing_clientkyc_action_permissions.xml" relativeToChangelogFile="true"/>
     <!-- NOTE: the numbers below (0341-0359) re-use prefixes already used above by the chequebook/CTS
          clearing catchup migrations — these come from a long-diverged branch (uate) that assigned its own
          sequence independently. Liquibase tracks changesets by filename + id + author, not by the numeric

fineract-provider/src/main/resources/db/changelog/tenant/parts/0420_add_missing_clientkyc_action_permissions.xml

@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied. See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!--
+        0216_add_client_kyc_tables.xml seeded 5 CLIENTKYC permissions (READ/CREATE/UPDATE/VERIFY/
+        REJECT), but 8 more @CommandType(entity="CLIENTKYC", ...) actions were added to the Java
+        command handlers afterward (GenerateAadhaarOtpClientKycCommandHandler,
+        VerifyAadhaarClientKycCommandHandler, VerifyPanClientKycCommandHandler,
+        VerifyCinClientKycCommandHandler, VerifyDinClientKycCommandHandler,
+        VerifyGstinClientKycCommandHandler, UploadCkycClientKycCommandHandler,
+        CompleteRekycClientKycCommandHandler) with no matching permission ever seeded for them.
+
+        The command-processing pipeline looks up the permission row by code BEFORE checking
+        whether the caller has been granted it - if the row doesn't exist at all, every user
+        (including a Super User with ALL_FUNCTIONS) gets "Permission with Code X does not exist",
+        not a normal 403. This seeds the 8 missing rows so those actions become usable at all;
+        granting them to specific roles is a separate, ordinary Manage Roles and Permissions step.
+    -->
+    <changeSet author="CBS" id="0420-add-missing-clientkyc-action-permissions">
+        <preConditions onFail="MARK_RAN">
+            <sqlCheck expectedResult="0">
+                SELECT COUNT(*) FROM m_permission WHERE code = 'GENERATEAADHAROTP_CLIENTKYC'
+            </sqlCheck>
+        </preConditions>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="GENERATEAADHAROTP_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="GENERATEAADHAROTP"/>
+            <column name="can_maker_checker" valueBoolean="false"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="VERIFYAADHAAR_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="VERIFYAADHAAR"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="VERIFYPAN_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="VERIFYPAN"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="VERIFYCIN_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="VERIFYCIN"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="VERIFYDIN_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="VERIFYDIN"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="VERIFYGSTIN_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="VERIFYGSTIN"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="UPLOADCKYC_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="UPLOADCKYC"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+        <insert tableName="m_permission">
+            <column name="grouping" value="portfolio"/>
+            <column name="code" value="COMPLETEREKYC_CLIENTKYC"/>
+            <column name="entity_name" value="CLIENTKYC"/>
+            <column name="action_name" value="COMPLETEREKYC"/>
+            <column name="can_maker_checker" valueBoolean="true"/>
+        </insert>
+    </changeSet>
+
+</databaseChangeLog>