DSC-2FA login fix + Individual-only link pickers + Title Case names

- DSC-as-2FA login: UI's claimAndValidate() now calls a new
  AuthenticationService.applyTwoFactorToken(token, liveSeconds) instead of
  validateOTP(). The /v1/login/dsc/{rn}/claim response is already a minted
  TFAccessToken — POSTing it to /twofactor/validate fails because that path
  expects an in-memory OTPRequest. applyTwoFactorToken runs only the
  post-success bookkeeping (interceptor.setTwoFactorAccessToken, setCredentials,
  Authentication Success alert that drives router.navigate(['/']), and
  sessionStorage persist of {token, validFrom, validTo}). Fixes the
  OTPTokenInvalidException users hit after a successful DSC verify+claim.

- Individual-only filter for link-client pickers: ClientTextSearch gains a
  legalFormType field; SearchingClientRepository accepts an Integer legalForm
  value and adds cb.equal(r.get("legalForm"), ...) to the spec.
  ClientSearchService.parseLegalForm tolerates INDIVIDUAL/PERSON/1 and
  NON_INDIVIDUAL/ENTITY/2; unknown = no filter so a typo doesn't blank results.
  UI: clients.service.ts searchByText gains a 7th optional arg; six link
  pickers (guardian, nominee, family-member across create flow and post-create
  tabs) now pass 'INDIVIDUAL'. General client list and signatory picker are
  intentionally unchanged.

- Title-case client names on persistence: ClientWritePlatformServiceJpa
  RepositoryImpl now runs first/middle/last/full name fields through
  toTitleCase() on both create and update paths. "aditya kumar vyas",
  "ADITYA KUMAR VYAS", "Aditya Kumar Vyas" all persist as "Aditya Kumar Vyas".
  Whitespace-split title case; preserves hyphens/apostrophes inside words
  without re-capitalising after them so clerks verifying against ID documents
  see predictable output.

- Migration 0296: unique constraint to prevent duplicate nominee per account
  type (the underlying repository + service changes also persisted in this
  commit complete the enforcement path).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -307,4 +307,5 @@
     <include file="parts/0293_create_m_dsc_challenge.xml" relativeToChangelogFile="true"/>
     <include file="parts/0294_add_tfa_token_to_dsc_challenge.xml" relativeToChangelogFile="true"/>
     <include file="parts/0295_unique_email_mobile_on_m_appuser.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0296_unique_nominee_per_account_type.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0296_unique_nominee_per_account_type.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership. The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License. You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!--
+        Belt-and-braces DB constraint matching the service-level uniqueness check in
+        ClientNomineeWritePlatformServiceImpl: the same person may not be linked as a nominee
+        more than once per (account owner, account type). Soft-deleted rows are excluded via the
+        WHERE clause so revoke + re-add stays possible.
+
+        Partial unique index (Postgres). If the platform ever runs on MariaDB / MySQL the WHERE
+        clause must be dropped — JpaSpecification fallback in the service will still enforce the
+        rule but at slightly higher cost.
+    -->
+    <changeSet id="0296_unique_nominee_per_account_type" author="fineract" dbms="postgresql">
+        <preConditions onFail="MARK_RAN">
+            <tableExists tableName="m_client_nominee"/>
+        </preConditions>
+        <sql>
+            CREATE UNIQUE INDEX IF NOT EXISTS uq_client_nominee_per_account_type
+            ON m_client_nominee (client_id, nominee_client_id, account_type)
+            WHERE is_deleted = false;
+        </sql>
+        <rollback>
+            <sql>DROP INDEX IF EXISTS uq_client_nominee_per_account_type;</sql>
+        </rollback>
+    </changeSet>
+
+</databaseChangeLog>