feat(clients): dual-OTP contact-change verification, webcam signature capture, and client history tab

Frontend counterpart to the backend dual-OTP contact-change feature:

- New ContactOtpBlockComponent (6-box segmented OTP input) used up to 4x in
  Edit Client (old/new mobile, old/new email — grouped under per-field
  sub-headers) and once each for mobile/email in Create Client, gating
  Save/Save & Next until every required box is verified.
- edit-client.component.ts: detects mobile/email/DOB changes against the
  loaded snapshot using local-date comparison (not `.toISOString()`, which
  false-triggers a day-shift in positive-UTC-offset timezones) and
  trimmed/case-insensitive email comparison (autofill whitespace or re-typed
  casing no longer reads as a change the masked preview can't explain).
- client-kyc-step.component.ts: new `invalidFieldLabels` getter names every
  currently-invalid required KYC field, surfaced via the Save & Next tooltip
  in both create-client and edit-client so a greyed-out button always
  explains what's still missing instead of a generic message.
- CaptureImageDialogComponent generalized for both profile photo and
  signature (photograph-a-paper-signature) capture:
  - Frame aspect now matches the requested getUserMedia resolution
    (4:3 profile / 16:9 signature) with object-fit: cover, eliminating the
    pillarboxing (black bars) a mismatched box previously caused.
  - Suppresses Chromium's auto-injected PiP/cast corner overlay icons.
  - Frame height capped in vh (not just px) so the dialog fits short
    viewports instead of pushing Cancel/Upload below the fold.
- upload-document-dialog.component.ts: generic Documents-tab upload now also
  offers "Capture from Webcam" alongside Browse, reusing the same capture
  dialog.
- New client History tab (reuses the existing Audit Trail data, scoped to
  this client) and dataUrlToFile/dataUrlToBlob util for routing webcam
  captures through the same upload pipelines as a picked file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/clients/clients.service.ts

@@ -16,6 +16,7 @@ import { switchMap } from 'rxjs/operators';
 import { map, catchError } from 'rxjs/operators';
 
 import { environment } from 'environments/environment';
+import { dataUrlToFile } from 'app/shared/utils/data-url.util';
 
 /**
  * Clients service.
@@ -230,6 +231,63 @@ export class ClientsService {
     return this.http.get(`/clients/${clientId}/documents/${documentId}/attachment`, { responseType: 'blob' });
   }
 
+  /**
+   * Uploads a webcam-captured signature (photograph of a paper signature).
+   * Mirrors `uploadClientSignatureImage()`'s multipart shape (name=clientSignature)
+   * exactly, but the source is a captured `data:` URL rather than a picked `File`.
+   */
+  uploadCapturedClientSignature(clientId: string, imageDataUrl: string) {
+    const formData = new FormData();
+    formData.append('file', dataUrlToFile(imageDataUrl, 'clientSignature.jpg'));
+    formData.append('name', 'clientSignature');
+    formData.append('description', 'Client signature (captured via webcam)');
+    return this.http.post(`/clients/${clientId}/documents`, formData);
+  }
+
+  /**
+   * Generates an OTP against a client's OLD or NEW mobile/email destination, ahead of a
+   * sensitive contact-detail change. Dual-OTP verification (old + new) is required before
+   * the mobileNo/emailAddress change is accepted by the backend — see `verifyClientContactOtp()`.
+   * @param clientId Client ID
+   * @param channel 'MOBILE' | 'EMAIL'
+   * @param destination Raw mobile number or email address to send the OTP to
+   */
+  sendClientContactOtp(clientId: string, channel: 'MOBILE' | 'EMAIL', destination: string): Observable<any> {
+    return this.http.post(`/clients/${clientId}/contact-verification/otp`, { channel, destination });
+  }
+
+  /**
+   * Verifies an OTP previously generated via `sendClientContactOtp()`.
+   * @param clientId Client ID
+   * @param otpId ID returned by the generate call
+   * @param otp 6-digit code entered by staff on the customer's behalf
+   */
+  verifyClientContactOtp(clientId: string, otpId: number, otp: string): Observable<any> {
+    return this.http.post(`/clients/${clientId}/contact-verification/otp/verify`, { otpId, otp });
+  }
+
+  /**
+   * Generates an OTP against a NOT-YET-CREATED client's mobile/email, ahead of the initial
+   * `POST /clients` call. There is no clientId yet, so this hits the clientId-less sibling
+   * endpoint (`ClientCreationContactVerificationApiResource`) rather than
+   * `sendClientContactOtp()`'s `/clients/{clientId}/...` shape. The returned otpId is sent
+   * back as `mobileNewOtpId`/`emailNewOtpId` on `createClient()`.
+   * @param channel 'MOBILE' | 'EMAIL'
+   * @param destination Raw mobile number or email address to send the OTP to
+   */
+  sendClientCreationContactOtp(channel: 'MOBILE' | 'EMAIL', destination: string): Observable<any> {
+    return this.http.post(`/clients/contact-verification/otp`, { channel, destination });
+  }
+
+  /**
+   * Verifies an OTP previously generated via `sendClientCreationContactOtp()`.
+   * @param otpId ID returned by the generate call
+   * @param otp 6-digit code entered by staff on the customer's behalf
+   */
+  verifyClientCreationContactOtp(otpId: number, otp: string): Observable<any> {
+    return this.http.post(`/clients/contact-verification/otp/verify`, { otpId, otp });
+  }
+
   getClientFamilyMembers(clientId: string) {
     return this.http.get(`/clients/${clientId}/familymembers`);
   }