fix(clients): rebuild CKYC document upload as a popup with full proof details

The CKYC tab's document cards now open a dedicated dialog (with client-side
preview) instead of expanding inline, collecting document type, number, and
issue/expiry dates the same way client creation does. Fixes several bugs
found along the way:

- Uploading a document type that's valid for both identity and address
  (Aadhaar, Passport, etc.) no longer 404s or 500s — the "no such endpoint"
  and case-sensitive ClientIdentifierStatus.valueOf("Active") crashes are
  both resolved.
- Edit Client's Identity-proof and Address-proof steps no longer show each
  other's document when both are dual-purpose OVD types, and no longer show
  stale/mismatched front-back scans after a document type change.
- Address-proof's own document preview never showed a document at all when
  no m_client_kyc record existed yet.

Document number and issue/expiry dates are persisted on the identifier
(documentKey + a shared "Issue date: ..., Expiry date: ..." description
convention) and read back by both the CKYC tab and Edit Client so the same
details appear everywhere.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/clients/client-stepper/client-kyc-step/client-kyc-step.component.ts

@@ -7,6 +7,7 @@
  */
 
 import { Component, Input, OnInit, OnChanges, OnDestroy, SimpleChanges, inject } from '@angular/core';
+import { forkJoin, catchError, of } from 'rxjs';
 import { UntypedFormBuilder, UntypedFormGroup, Validators, FormsModule } from '@angular/forms';
 import {
   MatDialog,
@@ -1266,8 +1267,14 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
         this.loadExistingKycIdentifier(data?.kycDocumentName);
       },
       error: () => {
-        // No existing KYC — that's fine for new clients
+        // No m_client_kyc row yet (e.g. CERSAI sync hasn't run) — that's fine, but the client
+        // can still have a KYC-type identifier already on file (uploaded via the CKYC tab,
+        // which writes straight to client_identifier and never touches this record). Look it
+        // up the same way the success branch does, just without a document-name hint.
         this.kycLoaded = true;
+        this.loadExistingPhoto();
+        this.loadExistingSignature();
+        this.loadExistingKycIdentifier(undefined);
       }
     });
   }
@@ -1283,8 +1290,13 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
    */
   private loadExistingKycIdentifier(kycDocumentName: string | undefined): void {
     if (!this.clientId) return;
-    this.clientsService.getClientIdentifiers(this.clientId).subscribe({
-      next: (identifiers: any[]) => {
+    forkJoin({
+      identifiers: this.clientsService.getClientIdentifiers(this.clientId),
+      // Only needed to spot the dual-purpose OVD types (Aadhaar/Passport/Voter ID/Driving
+      // Licence) below — a failure here just means that disambiguation step is skipped.
+      proofTypes: this.clientsService.getKycProofTypes().pipe(catchError(() => of({ addressProofs: [] })))
+    }).subscribe({
+      next: ({ identifiers, proofTypes }: { identifiers: any[]; proofTypes: any }) => {
         if (!identifiers || identifiers.length === 0) return;
         const cleanStr = (s: string) => (s || '').toLowerCase().replace(/[^a-z0-9]/g, '');
         const isKycType = (i: any) => {
@@ -1297,6 +1309,13 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
             })
           );
         };
+        // Aadhaar, Passport, Voter ID and Driving Licence are valid OVDs for BOTH this slot and
+        // the separate address-proof one (client-india-address-step) — a client with, say, a PAN
+        // identity proof and an Aadhaar address proof has two client_identifier rows that both
+        // pass isKycType. Without a name to go on, prefer whichever candidate is NOT also an
+        // address-proof type, so this slot doesn't grab the other step's file.
+        const addressTypeNames = new Set<string>((proofTypes?.addressProofs || []).map((p: any) => cleanStr(p?.name)));
+        const isAddressType = (i: any) => addressTypeNames.has(cleanStr(i?.documentType?.name));
         // Re-uploading a KYC document creates a new identifier row rather than updating the
         // old one in place (same pattern as OVD identifiers), so sort newest-first before
         // picking — otherwise a repeat upload of the same document type would keep showing
@@ -1311,7 +1330,15 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
               return name === kName || name.includes(kName) || kName.includes(name);
             })
           : null;
-        const identifier = match || sorted.find(isKycType);
+        // Last resort, when EVERY kyc-type candidate is also address-eligible (e.g. a client
+        // whose identity proof and address proof are both Aadhaar/Passport/Voter ID/Driving
+        // Licence): this stepper always runs before the address step in both the create and
+        // edit wizards, so the identity proof is the one that was on file first — pick the
+        // OLDEST match here, and the address step (client-india-address-step) picks the NEWEST
+        // among ITS own address-eligible candidates, so the two steps land on different rows
+        // without needing to coordinate at runtime.
+        const identifier =
+          match || sorted.find((i) => isKycType(i) && !isAddressType(i)) || [...sorted].reverse().find(isKycType);
         if (!identifier?.id) return;
 
         this.existingKycIdentifierId = identifier.id.toString();
@@ -1327,6 +1354,19 @@ export class ClientKycStepComponent implements OnInit, OnChanges, OnDestroy {
             kycDocumentNumber: identifier.documentKey || ''
           });
         }
+        // Same for issue/expiry date — the CKYC tab (and client-india-address-step, for address
+        // proof) write "Issue date: yyyy-MM-dd, Expiry date: yyyy-MM-dd" into the identifier's
+        // description; read it back here only to fill in whatever the KYC record itself doesn't
+        // already have, same as the documentKey backfill above.
+        const desc: string = identifier?.description || '';
+        const issueMatch = desc.match(/Issue date:\s*([^,|]+)/i);
+        const expiryMatch = desc.match(/Expiry date:\s*([^,|]+)/i);
+        if (issueMatch && !this.kycForm.get('kycDocIssueDate')?.value) {
+          this.kycForm.patchValue({ kycDocIssueDate: this.parseApiDate(issueMatch[1].trim()) });
+        }
+        if (expiryMatch && !this.kycForm.get('kycDocExpiryDate')?.value) {
+          this.kycForm.patchValue({ kycDocExpiryDate: this.parseApiDate(expiryMatch[1].trim()) });
+        }
 
         this.clientsService.getClientIdentificationDocuments(this.existingKycIdentifierId).subscribe({
           next: (docs: any[]) => {