feat: MFA/2FA, OTP audit logs, KYC + client/user enhancements

- Access Control module: SMS/Email/TOTP/Hardware-token MFA factor management
- OTP Audit Logs module under Admin menu (list + detail) with 401/403 handling
- Two-factor authentication login flow updates
- Client KYC, India address, family-members, ckyc, nominee enhancements
- New shared KYC helpers (kyc-proof-types, kyc-upload-helper.service)
- User create/edit/view enhancements
- Shell navigation: OTP Audit Logs entry under real Admin menu

src/app/clients/clients-view/ckyc-tab/ckyc-tab.component.ts

@@ -67,6 +67,18 @@ export class CkycTabComponent implements OnInit, OnDestroy {
   ckycBatchId = '';
   checkingExisting = false;
 
+  /** KYC verification status (Aadhaar + PAN) — independent of CERSAI sync */
+  panVerified = false;
+  aadhaarVerified = false;
+  panHolderName = '';
+  aadhaarHolderName = '';
+  panNumber = '';
+  aadhaarMasked = '';
+
+  get kycComplete(): boolean {
+    return this.panVerified && this.aadhaarVerified;
+  }
+
   /** Pre-existing artefacts detected from client data */
   existing: Record<'ADDRESS_PROOF' | 'PHOTO_PROOF' | 'CLIENT_IMAGE' | 'CLIENT_SIGNATURE', ExistingArtefact> = {
     ADDRESS_PROOF: { present: false },
@@ -170,6 +182,13 @@ export class CkycTabComponent implements OnInit, OnDestroy {
         this.ckycNumber = data?.ckycNumber || '';
         this.ckycUploadedOn = this.formatJavaDate(data?.ckycUploadedOn);
         this.ckycBatchId = data?.ckycBatchId || '';
+        this.panVerified = data?.panVerified === true || data?.panVerified === 'true' || data?.panVerified === 1;
+        this.aadhaarVerified =
+          data?.aadhaarVerified === true || data?.aadhaarVerified === 'true' || data?.aadhaarVerified === 1;
+        this.panHolderName = data?.panFullName || data?.panHolderName || '';
+        this.aadhaarHolderName = data?.aadhaarHolderName || '';
+        this.panNumber = data?.panNumber || '';
+        this.aadhaarMasked = data?.aadhaarNumberMasked || '';
       });
   }