docs(plan): Sprint 5B — markdownlint-fix плана (MD031/MD032)

markdownlint-cli2 --fix: blanks-around-lists/fences в плане 5B.
0 errors. Pre-existing 26 ошибок в планах Sprint 4/5A — вне scope.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/agents/rls-reviewer.md

@@ -7,6 +7,7 @@ description: |
   (crm_app_user, crm_app_admin, crm_supplier_worker BYPASSRLS,
   crm_readonly, crm_migrator). Reports orphan policies, missing tenant_id
   columns, inconsistent GRANTs, missing CHANGELOG entries.
+  For manually checking a single named table before commit - use the /rls-check skill.
 tools: Read, Grep, Glob, Bash
 ---
 
@@ -35,6 +36,23 @@ SaaS-level таблицы (e.g., `supplier_csv_reconcile_log`, `system_settings`
 
 Каждое schema change требует записи в `db/CHANGELOG_schema.md` (CLAUDE.md §5 п.8).
 
+## Граница со скилом /rls-check
+
+`rls-reviewer` (этот агент) и скил `/rls-check`
+(`.claude/skills/rls-check/SKILL.md`) оба проверяют RLS. Правило выбора:
+
+- Есть diff / ветка / PR с изменениями БД, набор таблиц заранее не известен →
+  **этот агент**.
+- Знаешь имя одной конкретной таблицы, проверка вручную перед коммитом →
+  **скил `/rls-check <table>`**.
+
+Этот агент прогоняет **7 статических пунктов** чеклиста. Живой дымовой тест
+(`pest --filter RlsSmokeTest`) намеренно **не входит** в агентский чеклист:
+запуск Pest в ревью-субагенте медленный и задевает гонки `--parallel`
+(квирки 72/77, см. `.claude/agents/pest-parallel-debugger.md`). Живой дымовой
+тест — 8-я строка скила `/rls-check`. 7 пунктов агента === первые 7 строк
+вывода скила (общее статическое ядро).
+
 ## Workflow
 
 1. Read target migration файл OR `db/schema.sql` diff (use `git diff HEAD~1 -- db/schema.sql` или указанные изменения).
@@ -77,6 +95,8 @@ Pass: <N>/7
 - General SQL style (squawk handles).
 - Business logic review (other agents).
 - Performance review (separate concern).
+- Проверка одной названной таблицы вручную перед коммитом + живой дымовой
+  тест — сценарий скила `/rls-check`, не агента.
 
 ## Verification protocol
 

.claude/settings.json

@@ -37,6 +37,24 @@
     ]
   },
   "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"C:/моя/проекты/портал crm/Документация/tools/ruflo-recall-hook.mjs\""
+          }
+        ]
+      },
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"C:/моя/проекты/портал crm/Документация/tools/ruflo-queen-hook.mjs\""
+          }
+        ]
+      }
+    ],
     "PreToolUse": [
       {
         "matcher": "Edit|Write",

.claude/skills/regression/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: regression
+description: |
+  Run the project regression sweep and report a canonical status line + GREEN/RED/RED-INCOMPLETE verdict.
+  Two tiers: `quick` (lint/format/type-check — seconds) and `full` (everything incl.
+  Pest --parallel, Larastan, Vitest, Vite build, lychee, gitleaks — minutes).
+  Claude auto-runs only `quick` (e.g. during verification-before-completion);
+  `full` runs only on explicit `/regression full` or with user confirmation.
+---
+
+# Regression — канонический регрессионный свод
+
+## Когда использовать
+
+Перед закрытием задачи/спринта (`full`) или для быстрого фидбэка по ходу работы
+(`quick`). Скилл инкапсулирует ~12 команд свода, разбросанных по `package.json`,
+`app/package.json`, `app/composer.json` и `lefthook.yml`, в один вызов с
+детерминированной канонической строкой и машинным вердиктом.
+
+Invoke via `/regression [quick|full]` (без аргумента → `full`).
+
+## Workflow
+
+1. Определить уровень из аргумента: `quick`, `full`, либо `full` по умолчанию.
+2. Запустить через Bash из корня репозитория:
+
+   ```bash
+   node .claude/skills/regression/run.mjs <tier>
+   ```
+
+3. Показать пользователю полный вывод скрипта (таблица + каноническая строка +
+   вердикт + вывод упавших проверок).
+4. Интерпретировать вердикт:
+   - `GREEN` — свод чист, exit-код 0.
+   - `RED` — перечислены упавшие проверки, exit-код 1; полный вывод каждой —
+     после вердикта.
+   - `RED-INCOMPLETE` — проверка не прогналась (нет бинаря), exit-код 1; свод
+     неполон, зелёным признать нельзя. Если одновременно есть упавшие проверки,
+     они тоже перечислены в строке вердикта.
+
+## Уровни
+
+- **`quick`** (6 проверок, секунды): Pint, ESLint, Prettier, vue-tsc,
+  markdownlint, cspell.
+- **`full`** (12 проверок, минуты): всё из `quick` + Larastan, Pest `--parallel`,
+  Vitest, Vite build, lychee, gitleaks.
+
+## Правила инвокации (self-restraint)
+
+- Claude **авто-запускает только `quick`** — в том числе в рамках
+  `superpowers:verification-before-completion` перед claim «готово» / «passed» /
+  «closed».
+- `full` Claude **сам не запускает** — только по явному `/regression full` от
+  пользователя ИЛИ запросив подтверждение («запускаю полный свод, ~5–10 мин — ок?»).
+- Скилл **не правит `CLAUDE.md`** — он только печатает каноническую строку в
+  stdout; вставка строки в `CLAUDE.md` — отдельно, через канал
+  `claude-md-management` (`CLAUDE.md` §5 п.10).
+
+## Caveats
+
+- **Pest `--parallel` flake (квирки 72/73/77).** Если Pest показал 1–3 ошибки,
+  похожие на Redis-race / cumulative-state / unique-key-collision, — перепрогнать
+  `full` один раз ИЛИ свериться с агентом `pest-parallel-debugger` до объявления
+  реального RED.
+- **ruflo daemon (квирк 93).** Перед baseline-критичным `full` рассмотреть
+  `pm2 stop ruflo-daemon` — worker-jitter усиливает Pest-flake.
+- gitleaks и lychee: на Windows берутся из `bin\*.exe`, на Linux/Mac CI — из
+  `PATH`. Отсутствие бинаря → `[⚠] SKIPPED` + вердикт `RED-INCOMPLETE`.
+
+## Не использовать когда
+
+- Нужна одна конкретная проверка — запусти её npm/composer-скрипт напрямую
+  (быстрее, чем весь свод).
+- Pa11y и Semgrep SAST — это CI-tier, в свод намеренно не входят (см. дизайн-спек
+  `docs/superpowers/specs/2026-05-16-regression-skill-design.md` §5).

.claude/skills/regression/run.mjs

@@ -0,0 +1,258 @@
+#!/usr/bin/env node
+// .claude/skills/regression/run.mjs
+// Regression sweep orchestrator for the /regression skill.
+// Design: docs/superpowers/specs/2026-05-16-regression-skill-design.md
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import process from 'node:process';
+
+// ── pure: platform binary resolution ───────────────────────────────
+export function resolveBinary(name, platform = process.platform) {
+  return platform === 'win32' ? `bin\\${name}.exe` : name;
+}
+
+// ── pure: output header line ───────────────────────────────────────
+export function buildHeader(tier) {
+  const head = `─ /regression ${tier} `;
+  return head + '─'.repeat(Math.max(3, 48 - head.length));
+}
+
+// ── pure: exit-code token ──────────────────────────────────────────
+export function parseExit(label, code) {
+  return `${label} ${code}`;
+}
+
+// ── pure: test-count parsers ───────────────────────────────────────
+export function parsePest(stdout) {
+  // pest --parallel emits a single JSON line: {"tool":"pest","result":...,"tests":N,"passed":N,"skipped":N,...}
+  const jsonMatch = stdout.match(/\{"tool"\s*:\s*"pest"[^}]+\}/);
+  if (jsonMatch) {
+    try {
+      const j = JSON.parse(jsonMatch[0]);
+      const passed = Number(j.passed ?? 0);
+      const skipped = Number(j.skipped ?? 0);
+      const total = Number(j.tests ?? passed + skipped);
+      const failed = total - passed - skipped;
+      return `Pest ${total}/${passed}/${skipped}sk/${Math.max(0, failed)}`;
+    } catch { /* fall through to regex */ }
+  }
+  const passed = Number(stdout.match(/(\d+)\s+passed/)?.[1] ?? 0);
+  const skipped = Number(stdout.match(/(\d+)\s+skipped/)?.[1] ?? 0);
+  const failed = Number(stdout.match(/(\d+)\s+failed/)?.[1] ?? 0);
+  return `Pest ${passed + skipped + failed}/${passed}/${skipped}sk/${failed}`;
+}
+
+export function parseVitest(stdout) {
+  const filesLine = stdout.match(/^.*Test Files.+$/m)?.[0] ?? '';
+  const files = Number(filesLine.match(/(\d+)\s+passed/)?.[1] ?? 0);
+  const line = stdout.match(/^\s*Tests\s+.+$/m)?.[0] ?? '';
+  const passed = Number(line.match(/(\d+)\s+passed/)?.[1] ?? 0);
+  const skipped = Number(line.match(/(\d+)\s+skipped/)?.[1] ?? 0);
+  const failed = Number(line.match(/(\d+)\s+failed/)?.[1] ?? 0);
+  return `Vitest ${files}f/${passed}/${skipped}sk/${failed}`;
+}
+
+// ── pure: content parsers ──────────────────────────────────────────
+export function parseViteBuild(stdout) {
+  const m = stdout.match(/built in ([\d.]+)\s*s/i);
+  return `Vite build ${m ? m[1] : '?'}s`;
+}
+
+export function parseLarastan(stdout) {
+  const m = stdout.match(/Found (\d+) error/i);
+  return `Larastan ${m ? m[1] : 0}`;
+}
+
+export function parseGitleaks(stdout, code) {
+  const commits = stdout.match(/(\d+)\s+commits?\s+scanned/i)?.[1] ?? '?';
+  const leaks = code === 0
+    ? '0'
+    : (stdout.match(/(\d+)\s+leaks?\s+found/i)?.[1]
+       ?? stdout.match(/leaks?\s+found:?\s*(\d+)/i)?.[1]
+       ?? '≥1');
+  return `gitleaks ${leaks}/${commits}`;
+}
+
+export function parseLychee(stdout) {
+  const ok = stdout.match(/(\d+)\s+OK/)?.[1] ?? '?';
+  const errors = stdout.match(/(\d+)\s+Errors?/i)?.[1] ?? '0';
+  return `lychee ${ok}/${errors}`;
+}
+
+// ── pure: verdict ──────────────────────────────────────────────────
+export function computeVerdict(results) {
+  const skipped = results.filter((r) => r.skipped).map((r) => r.label);
+  const failed = results
+    .filter((r) => !r.skipped && r.code !== 0)
+    .map((r) => r.label);
+  if (skipped.length) return { verdict: 'RED-INCOMPLETE', exitCode: 1, failed, skipped };
+  if (failed.length) return { verdict: 'RED', exitCode: 1, failed, skipped };
+  return { verdict: 'GREEN', exitCode: 0, failed, skipped };
+}
+
+// ── pure: output formatting ────────────────────────────────────────
+export function buildCanonicalLine(results) {
+  return results.map((r) => r.token).join(' / ');
+}
+
+export function formatRow(r) {
+  const mark = r.skipped ? '⚠' : r.code === 0 ? '✅' : '❌';
+  const label = r.label.padEnd(14);
+  const status = r.skipped
+    ? 'SKIPPED — binary not found'
+    : `${r.code}   ${(r.ms / 1000).toFixed(1)}s`;
+  return `[${mark}] ${label}${status}`;
+}
+
+export function verdictLine(v, total) {
+  if (v.verdict === 'GREEN') {
+    return `🟢 GREEN — все ${total} проверок passed`;
+  }
+  if (v.verdict === 'RED-INCOMPLETE') {
+    const tail = v.failed.length ? `; провал: ${v.failed.join(', ')}` : '';
+    return `🟠 RED-INCOMPLETE — не прогналось: ${v.skipped.join(', ')}${tail}`;
+  }
+  return `🔴 RED — ${v.failed.length}/${total} failed: ${v.failed.join(', ')}`;
+}
+
+// ── data: checks registry ──────────────────────────────────────────
+// Script-based checks carry `cmd`; binary-based checks carry `bin` + `argv`.
+// `parse(combinedOutput, exitCode)` → canonical token. `cwd`: '.' = repo root,
+// 'app' = the Laravel app. Execution order: quick checks first, then heavy.
+export const CHECKS = [
+  {
+    id: 'pint', label: 'Pint', tiers: ['quick', 'full'], cwd: 'app',
+    cmd: 'composer pint:test', parse: (_o, c) => parseExit('Pint', c),
+  },
+  {
+    id: 'eslint', label: 'ESLint', tiers: ['quick', 'full'], cwd: 'app',
+    cmd: 'npm run lint:vue', parse: (_o, c) => parseExit('ESLint', c),
+  },
+  {
+    id: 'prettier', label: 'Prettier', tiers: ['quick', 'full'], cwd: 'app',
+    cmd: 'npm run format:check', parse: (_o, c) => parseExit('Prettier', c),
+  },
+  {
+    id: 'vue-tsc', label: 'vue-tsc', tiers: ['quick', 'full'], cwd: 'app',
+    cmd: 'npm run type-check', parse: (_o, c) => parseExit('vue-tsc', c),
+  },
+  {
+    id: 'markdownlint', label: 'markdownlint', tiers: ['quick', 'full'], cwd: '.',
+    cmd: 'npm run lint:md', parse: (_o, c) => parseExit('markdownlint', c),
+  },
+  {
+    id: 'cspell', label: 'cspell', tiers: ['quick', 'full'], cwd: '.',
+    cmd: 'npm run spell', parse: (_o, c) => parseExit('cspell', c),
+  },
+  {
+    id: 'larastan', label: 'Larastan', tiers: ['full'], cwd: 'app',
+    cmd: 'composer stan', parse: (o) => parseLarastan(o),
+  },
+  {
+    id: 'pest', label: 'Pest', tiers: ['full'], cwd: 'app',
+    cmd: 'composer test:parallel', parse: (o) => parsePest(o),
+  },
+  {
+    id: 'vitest', label: 'Vitest', tiers: ['full'], cwd: 'app',
+    cmd: 'npm run test:vue', parse: (o) => parseVitest(o),
+  },
+  {
+    id: 'vite-build', label: 'Vite build', tiers: ['full'], cwd: 'app',
+    cmd: 'npm run build', parse: (o) => parseViteBuild(o),
+  },
+  {
+    id: 'lychee', label: 'lychee', tiers: ['full'], cwd: '.',
+    bin: 'lychee',
+    argv: ['--config', '.lychee.toml', 'docs/**/*.md', 'db/**/*.md', '*.md'],
+    parse: (o) => parseLychee(o),
+  },
+  {
+    id: 'gitleaks', label: 'gitleaks', tiers: ['full'], cwd: '.',
+    bin: 'gitleaks',
+    argv: ['detect', '--source', '.', '--no-banner', '--config', '.gitleaks.toml', '--redact'],
+    parse: (o, c) => parseGitleaks(o, c),
+  },
+];
+
+// ── I/O: run one check ─────────────────────────────────────────────
+function runCheck(check, repoRoot) {
+  const cwd = check.cwd === '.' ? repoRoot : path.join(repoRoot, check.cwd);
+  const start = Date.now();
+  const skippedResult = (reason) => ({
+    id: check.id, label: check.label, skipped: true, code: null,
+    ms: Date.now() - start, token: `${check.label} SKIPPED`, stdout: '', stderr: reason,
+  });
+
+  let command;
+  if (check.bin) {
+    const bin = resolveBinary(check.bin);
+    // bin/ executables: existsSync pre-check on Windows (the project ships
+    // bin\gitleaks.exe / bin\lychee.exe; on POSIX they come from PATH).
+    if (process.platform === 'win32' && !existsSync(path.join(repoRoot, bin))) {
+      return skippedResult(`${bin} not found`);
+    }
+    command = [bin, ...check.argv].join(' ');
+  } else {
+    command = check.cmd;
+  }
+
+  const res = spawnSync(command, {
+    cwd, shell: true, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024,
+  });
+  const ms = Date.now() - start;
+  // ENOENT (POSIX missing binary), POSIX shell exit 127 ("command not found"),
+  // or the Windows cmd.exe "is not recognized" message → SKIPPED.
+  const notFound = (res.error && res.error.code === 'ENOENT')
+    || res.status === 127
+    || /is not recognized as an internal or external command/i.test(res.stderr ?? '');
+  if (notFound) {
+    return skippedResult(`command not found: ${command}`);
+  }
+  const stdout = res.stdout ?? '';
+  const stderr = res.stderr ?? '';
+  const code = res.status ?? 1;
+  const token = check.parse(`${stdout}\n${stderr}`, code);
+  return { id: check.id, label: check.label, skipped: false, code, ms, token, stdout, stderr };
+}
+
+// ── orchestrator ───────────────────────────────────────────────────
+export function main(argv) {
+  const tier = argv[0] ?? 'full';
+  if (tier !== 'quick' && tier !== 'full') {
+    process.stderr.write(
+      `regression: unknown argument "${tier}". Usage: run.mjs [quick|full]\n`,
+    );
+    process.exitCode = 2;
+    return;
+  }
+  const repoRoot = fileURLToPath(new URL('../../../', import.meta.url));
+  const checks = CHECKS.filter((c) => c.tiers.includes(tier));
+
+  process.stdout.write(`${buildHeader(tier)}\n`);
+  const results = [];
+  for (const check of checks) {
+    const r = runCheck(check, repoRoot);
+    results.push(r);
+    process.stdout.write(`${formatRow(r)}\n`);
+  }
+  process.stdout.write(`${'─'.repeat(48)}\n`);
+  process.stdout.write(`Canonical: ${buildCanonicalLine(results)}\n`);
+
+  const v = computeVerdict(results);
+  process.stdout.write(`VERDICT: ${verdictLine(v, results.length)}\n`);
+
+  // Full output of failed checks, so failures are visible with file:line.
+  for (const r of results) {
+    if (!r.skipped && r.code !== 0) {
+      process.stdout.write(`\n── ${r.label} output ──\n${r.stdout}\n${r.stderr}\n`);
+    }
+  }
+  process.exitCode = v.exitCode;
+}
+
+// Run main only when executed directly (not when imported by run.test.mjs).
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  main(process.argv.slice(2));
+}

.claude/skills/regression/run.test.mjs

@@ -0,0 +1,213 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import process from 'node:process';
+import {
+  resolveBinary, buildHeader, parseExit,
+  parsePest, parseVitest,
+  parseViteBuild, parseLarastan, parseGitleaks, parseLychee,
+  computeVerdict,
+  buildCanonicalLine, formatRow, verdictLine,
+  CHECKS,
+} from './run.mjs';
+
+test('resolveBinary: win32 → bin\\<name>.exe', () => {
+  assert.equal(resolveBinary('gitleaks', 'win32'), 'bin\\gitleaks.exe');
+});
+test('resolveBinary: non-win32 → bare name on PATH', () => {
+  assert.equal(resolveBinary('lychee', 'linux'), 'lychee');
+  assert.equal(resolveBinary('lychee', 'darwin'), 'lychee');
+});
+
+test('buildHeader: starts with the tier banner', () => {
+  assert.ok(buildHeader('quick').startsWith('─ /regression quick '));
+  assert.ok(buildHeader('full').startsWith('─ /regression full '));
+});
+test('buildHeader: is padded with dashes', () => {
+  assert.ok(buildHeader('full').length >= 30);
+});
+
+test('parseExit: builds "<label> <code>" token', () => {
+  assert.equal(parseExit('Pint', 0), 'Pint 0');
+  assert.equal(parseExit('ESLint', 1), 'ESLint 1');
+});
+
+test('parsePest: passed + skipped, no failures → total derived', () => {
+  const out = '  Tests:    3 skipped, 739 passed (2104 assertions)\n  Duration: 71.23s';
+  assert.equal(parsePest(out), 'Pest 742/739/3sk/0');
+});
+test('parsePest: with failures', () => {
+  const out = '  Tests:    2 failed, 1 skipped, 736 passed (2090 assertions)';
+  assert.equal(parsePest(out), 'Pest 739/736/1sk/2');
+});
+test('parsePest: passed only → zeros for skipped/failed', () => {
+  assert.equal(parsePest('  Tests:    19 passed (44 assertions)'), 'Pest 19/19/0sk/0');
+});
+test('parsePest: JSON format (pest --parallel) passed + skipped', () => {
+  const out = '{"tool":"pest","result":"passed","tests":793,"passed":790,"assertions":2391,"duration_ms":32200,"skipped":3}';
+  assert.equal(parsePest(out), 'Pest 793/790/3sk/0');
+});
+test('parsePest: JSON format with failures', () => {
+  const out = '{"tool":"pest","result":"failed","tests":793,"passed":788,"assertions":2380,"duration_ms":31000,"skipped":3}';
+  assert.equal(parsePest(out), 'Pest 793/788/3sk/2');
+});
+test('parsePest: JSON format no skipped', () => {
+  const out = '{"tool":"pest","result":"passed","tests":19,"passed":19,"assertions":44,"duration_ms":1711}';
+  assert.equal(parsePest(out), 'Pest 19/19/0sk/0');
+});
+
+test('parseVitest: files + passed + skipped', () => {
+  const out = ' Test Files  92 passed (92)\n      Tests  774 passed | 3 skipped (777)\n   Duration  12.6s';
+  assert.equal(parseVitest(out), 'Vitest 92f/774/3sk/0');
+});
+test('parseVitest: with failures, does not confuse "Test Files" with "Tests"', () => {
+  const out = ' Test Files  2 failed | 90 passed (92)\n      Tests  5 failed | 769 passed (774)';
+  assert.equal(parseVitest(out), 'Vitest 90f/769/0sk/5');
+});
+
+test('parseViteBuild: extracts build time', () => {
+  assert.equal(parseViteBuild('✓ 312 modules transformed.\n✓ built in 2.03s'), 'Vite build 2.03s');
+});
+test('parseViteBuild: no match → "?"', () => {
+  assert.equal(parseViteBuild('build crashed'), 'Vite build ?s');
+});
+
+test('parseLarastan: clean → 0', () => {
+  assert.equal(parseLarastan(' [OK] No errors'), 'Larastan 0');
+});
+test('parseLarastan: counts errors', () => {
+  assert.equal(parseLarastan(' [ERROR] Found 2 errors'), 'Larastan 2');
+});
+
+test('parseGitleaks: clean → 0 leaks', () => {
+  const out = 'INF 442 commits scanned.\nINF no leaks found';
+  assert.equal(parseGitleaks(out, 0), 'gitleaks 0/442');
+});
+test('parseGitleaks: leaks found (non-zero exit)', () => {
+  const out = 'INF 442 commits scanned.\nWRN 3 leaks found';
+  assert.equal(parseGitleaks(out, 1), 'gitleaks 3/442');
+});
+
+test('parseLychee: OK + errors', () => {
+  const out = '🔍 325 Total (in 9s)\n✅ 325 OK\n🚫 0 Errors';
+  assert.equal(parseLychee(out), 'lychee 325/0');
+});
+test('parseLychee: with broken links', () => {
+  const out = '🔍 327 Total\n✅ 325 OK\n🚫 2 Errors';
+  assert.equal(parseLychee(out), 'lychee 325/2');
+});
+
+test('computeVerdict: all exit 0 → GREEN, exit code 0', () => {
+  const v = computeVerdict([
+    { label: 'Pint', code: 0, skipped: false },
+    { label: 'ESLint', code: 0, skipped: false },
+  ]);
+  assert.equal(v.verdict, 'GREEN');
+  assert.equal(v.exitCode, 0);
+  assert.deepEqual(v.failed, []);
+});
+test('computeVerdict: one non-zero exit → RED, exit code 1', () => {
+  const v = computeVerdict([
+    { label: 'Pint', code: 0, skipped: false },
+    { label: 'Larastan', code: 1, skipped: false },
+  ]);
+  assert.equal(v.verdict, 'RED');
+  assert.equal(v.exitCode, 1);
+  assert.deepEqual(v.failed, ['Larastan']);
+});
+test('computeVerdict: a skipped check → RED-INCOMPLETE', () => {
+  const v = computeVerdict([
+    { label: 'Pint', code: 0, skipped: false },
+    { label: 'gitleaks', code: null, skipped: true },
+  ]);
+  assert.equal(v.verdict, 'RED-INCOMPLETE');
+  assert.equal(v.exitCode, 1);
+  assert.deepEqual(v.skipped, ['gitleaks']);
+});
+test('computeVerdict: skipped takes precedence over a failure', () => {
+  const v = computeVerdict([
+    { label: 'Larastan', code: 1, skipped: false },
+    { label: 'lychee', code: null, skipped: true },
+  ]);
+  assert.equal(v.verdict, 'RED-INCOMPLETE');
+  assert.deepEqual(v.failed, ['Larastan']);
+  assert.deepEqual(v.skipped, ['lychee']);
+});
+
+test('buildCanonicalLine: joins tokens in result order with " / "', () => {
+  const results = [
+    { token: 'Pint 0' }, { token: 'ESLint 0' }, { token: 'Pest 742/739/3sk/0' },
+  ];
+  assert.equal(buildCanonicalLine(results), 'Pint 0 / ESLint 0 / Pest 742/739/3sk/0');
+});
+
+test('formatRow: passed check → ✅ mark, label, code, time', () => {
+  const row = formatRow({ label: 'Pint', code: 0, ms: 1800, skipped: false });
+  assert.ok(row.startsWith('[✅] Pint'));
+  assert.ok(row.includes('1.8s'));
+});
+test('formatRow: failed check → ❌ mark', () => {
+  assert.ok(formatRow({ label: 'Larastan', code: 1, ms: 8400, skipped: false }).startsWith('[❌] Larastan'));
+});
+test('formatRow: skipped check → ⚠ mark + SKIPPED', () => {
+  const row = formatRow({ label: 'gitleaks', code: null, ms: 0, skipped: true });
+  assert.ok(row.startsWith('[⚠] gitleaks'));
+  assert.ok(row.includes('SKIPPED'));
+});
+
+test('verdictLine: GREEN', () => {
+  const line = verdictLine({ verdict: 'GREEN', failed: [], skipped: [] }, 12);
+  assert.ok(line.includes('🟢 GREEN'));
+  assert.ok(line.includes('12'));
+});
+test('verdictLine: RED lists failed checks', () => {
+  const line = verdictLine({ verdict: 'RED', failed: ['Larastan'], skipped: [] }, 12);
+  assert.ok(line.includes('🔴 RED'));
+  assert.ok(line.includes('Larastan'));
+});
+test('verdictLine: RED-INCOMPLETE lists skipped checks', () => {
+  const line = verdictLine({ verdict: 'RED-INCOMPLETE', failed: [], skipped: ['gitleaks'] }, 12);
+  assert.ok(line.includes('🟠 RED-INCOMPLETE'));
+  assert.ok(line.includes('gitleaks'));
+});
+
+test('CHECKS: quick tier has exactly 6 checks', () => {
+  assert.equal(CHECKS.filter((c) => c.tiers.includes('quick')).length, 6);
+});
+test('CHECKS: full tier has exactly 12 checks', () => {
+  assert.equal(CHECKS.filter((c) => c.tiers.includes('full')).length, 12);
+});
+test('CHECKS: quick is a strict subset of full', () => {
+  const full = new Set(CHECKS.filter((c) => c.tiers.includes('full')).map((c) => c.id));
+  for (const c of CHECKS.filter((c) => c.tiers.includes('quick'))) {
+    assert.ok(full.has(c.id), `${c.id} in quick must also be in full`);
+  }
+});
+test('CHECKS: every check has id, label, cwd, parse, and a command source', () => {
+  for (const c of CHECKS) {
+    assert.ok(c.id && c.label && c.cwd, `${c.id}: id/label/cwd`);
+    assert.equal(typeof c.parse, 'function', `${c.id}: parse is a function`);
+    assert.ok(c.cmd || (c.bin && Array.isArray(c.argv)), `${c.id}: has cmd or bin+argv`);
+  }
+});
+test('CHECKS: ids are unique', () => {
+  assert.equal(new Set(CHECKS.map((c) => c.id)).size, CHECKS.length);
+});
+
+const RUN = fileURLToPath(new URL('./run.mjs', import.meta.url));
+
+test('main: unknown argument → exit code 2 + error on stderr', () => {
+  try {
+    execFileSync(process.execPath, [RUN, 'bogus'], { encoding: 'utf8', stdio: 'pipe' });
+    assert.fail('expected non-zero exit');
+  } catch (err) {
+    assert.equal(err.status, 2);
+    assert.match(String(err.stderr), /unknown argument/i);
+  }
+});
+test('main: importing run.mjs does not auto-run the sweep', () => {
+  // If the import.meta guard were broken, importing run.mjs at the top of this
+  // file would have spawned a full sweep. Reaching this assertion proves it did not.
+  assert.ok(true);
+});

.claude/skills/rls-check/SKILL.md

@@ -5,6 +5,7 @@ description: |
   Use when adding a new table, adding/removing tenant_id column, or modifying
   RLS policies. Walks through 7-step checklist (tenant_id, ENABLE RLS, 2+ policies,
   5-role GRANTs, db/CHANGELOG_schema.md entry, squawk, smoke test).
+  For reviewing a diff, branch, or PR with DB changes - use the rls-reviewer agent.
 disable-model-invocation: true
 ---
 
@@ -16,6 +17,28 @@ disable-model-invocation: true
 
 Invoke via `/rls-check <table_name>`.
 
+## Граница с агентом rls-reviewer
+
+`rls-check` (этот скил) и `rls-reviewer` (агент, `.claude/agents/rls-reviewer.md`)
+оба проверяют RLS, но в разных ситуациях. Правило выбора:
+
+- Знаешь имя одной конкретной таблицы, проверка вручную перед коммитом →
+  **`/rls-check <table>`** (этот скил).
+- Есть diff / ветка / PR с изменениями БД, набор таблиц заранее не известен →
+  **агент `rls-reviewer`**.
+
+Скил работает в основном контексте по одной названной таблице и прогоняет
+**8 строк вывода** — 7 статических пунктов + живой дымовой тест
+(`pest --filter RlsSmokeTest`, шаг 7). Агент работает в отдельном контексте
+субагента, разбирает diff/миграцию/PR и прогоняет только **7 статических**
+строк — дымовой тест намеренно не запускает.
+
+Первые 7 строк вывода у обоих — общее статическое ядро (tenant_id, ENABLE RLS,
+SELECT/ALL политики, GRANT'ы 5 ролей, CHANGELOG, squawk). Это не дублирование:
+ядро проверок одно, сценарии вызова разные. Дымовой тест — только в скиле:
+запуск Pest в ревью-субагенте медленный и задевает гонки `--parallel`
+(квирки 72/77, см. `.claude/agents/pest-parallel-debugger.md`).
+
 ## Checklist
 
 1. **tenant_id column.** Grep `db/schema.sql` для `CREATE TABLE <name>`. Verify:
@@ -94,3 +117,5 @@ Or failure listing: `[❌] tenant_id column missing — db/schema.sql:NNNN`.
 
 - Modifying existing well-RLS'd table без новых columns — overhead.
 - Tables explicitly outside RLS (e.g., Laravel `migrations`, `cache` — internal).
+- Проверяешь не одну названную таблицу, а diff/ветку/PR с изменениями БД —
+  это сценарий агента `rls-reviewer`, не скила.

.gitignore

@@ -145,3 +145,45 @@ app/playwright/node_modules/
 
 # Vitest coverage output (app/coverage/) — генерируется npm run test:coverage
 /app/coverage/
+
+# ── Ruflo big-bang integration (2026-05-15) ──────────────────────────────────
+# ruflo runtime scaffolding и local-only routing config
+.claude-flow/
+CLAUDE.local.md
+# ruflo runtime state (created on activation 2026-05-15: memory DB + RuVector bridge)
+.swarm/
+ruvector.db
+# CLAUDE.md / .claude/ backups перед npx ruflo init --force (плановые artifacts Task 2.1)
+CLAUDE.md.pre-ruflo.bak
+.claude.pre-ruflo.bak/
+# ruflo install/dry-run logs (transient)
+ruflo-init.log
+ruflo-init-dryrun.log
+ruflo-mcp-stdout.log
+ruflo-mcp-stderr.log
+# ruflo init --force regen'ит 23 subdirs из upstream IPFS-registry — auto-regenerable, не tracking
+.claude/agents/analysis/
+.claude/agents/architecture/
+.claude/agents/browser/
+.claude/agents/consensus/
+.claude/agents/core/
+.claude/agents/custom/
+.claude/agents/data/
+.claude/agents/development/
+.claude/agents/devops/
+.claude/agents/documentation/
+.claude/agents/flow-nexus/
+.claude/agents/github/
+.claude/agents/goal/
+.claude/agents/optimization/
+.claude/agents/payments/
+.claude/agents/sona/
+.claude/agents/sparc/
+.claude/agents/specialized/
+.claude/agents/sublinear/
+.claude/agents/swarm/
+.claude/agents/templates/
+.claude/agents/testing/
+.claude/agents/v3/
+.claude/commands/
+.claude/helpers/

.mcp.json

@@ -37,6 +37,11 @@
       "command": "npx",
       "args": ["-y", "@modelcontextprotocol/server-redis", "redis://localhost:6379"],
       "comment": "Off-phase tool — Redis MCP для Memurai (Windows service, Redis 7-совместимый, localhost:6379). Pending формализация в Tooling §3.3 #35 — sync нормативки отдельным планом. Package: @modelcontextprotocol/server-redis@2025.4.25 — DEPRECATED по статусу npm («Package no longer supported»), но Anthropic source, простой протокол, рабочий. Post-MVP migration на community alternative (e.g., @easy-mcps/redis-mcp-server@1.0.8 или @wenit/redis-mcp-server@1.0.3) когда подтвердим trust. READ-ONLY use — отладка очередей, кэша, Pest --parallel race (memory quirk 72). НЕ для prod (нет prod). Если в будущем prod Redis с auth — отдельный entry redis-prod с url через env var."
+    },
+    "ruflo": {
+      "command": "npx",
+      "args": ["-y", "ruflo@latest", "mcp", "start"],
+      "comment": "Off-phase orchestration MCP — exposes ~210 ruflo tools (Core/Intelligence/Agents/Memory/DevTools). Package: ruflo v3.7.0-alpha.38+ MIT (npm `ruflo`, repo ruvnet/claude-flow legacy after rename Jan-2026; plugin namespace @claude-flow/*). Plugin discovery via IPFS (CID QmeXmAdbWVvT84GfDXPD2Vg1HWhiTW2VdZfRLhkS96KkX2) — Pinata+Cloudflare gateways flaky 2026-05-15, only ipfs.io reliable. stdio mode (no port-conflict). Big-bang integration per spec/plan 2026-05-15-ruflo-integration-design.md (commit a68a0a0+). Pending формализация в Tooling §4.10 — Phase 3 Task 3.4."
     }
   }
 }

app/README.md

@@ -56,3 +56,29 @@ If you discover a security vulnerability within Laravel, please send an e-mail t
 ## License
 
 The Laravel framework is open-sourced software licensed under the [MIT license](https://opensource.org/licenses/MIT).
+
+## Демо-данные (dev)
+
+Демо-tenant создаётся `DemoSeeder` автоматически при `composer setup` /
+`php artisan migrate --seed` в окружениях `local` и `testing`
+(см. `DatabaseSeeder` — в `production` DemoSeeder не запускается).
+
+**Учётные данные демо-входа:**
+
+- URL: `/login`
+- Email: `admin@demo.local`
+- Пароль: `password`
+
+Что создаётся: demo-tenant (`subdomain=demo`, баланс 1000 ₽ / 100 лидов),
+admin-пользователь, 3 проекта (сайт/звонок/СМС) и ~14 демо-сделок.
+
+**Пере-сидировать демо-данные** (идемпотентно — повторный запуск не создаёт дублей):
+
+```bash
+composer demo:seed
+```
+
+Эквивалент: `php artisan db:seed --class=DemoSeeder --force`.
+
+Если при логине демо-аккаунта возвращается 422 — демо-данные не засеяны
+на текущей dev-БД (например, после `migrate:fresh`); запустите `composer demo:seed`.

app/app/Console/Commands/PartitionsCreateMonths.php

@@ -4,9 +4,9 @@ declare(strict_types=1);
 
 namespace App\Console\Commands;
 
+use App\Services\MonthlyPartitionManager;
 use Illuminate\Console\Command;
 use Illuminate\Support\Carbon;
-use Illuminate\Support\Facades\DB;
 
 /**
  * Создаёт ежемесячные партиции для `deals` и `supplier_lead_costs`
@@ -30,14 +30,7 @@ class PartitionsCreateMonths extends Command
     /** @var string */
     protected $description = 'Создаёт ежемесячные партиции deals и supplier_lead_costs на N месяцев вперёд (idempotent)';
 
-    /**
-     * Список таблиц, которые партиционируются по received_at помесячно.
-     *
-     * @var array<int, string>
-     */
-    private const PARTITIONED_TABLES = ['deals', 'supplier_lead_costs'];
-
-    public function handle(): int
+    public function handle(MonthlyPartitionManager $manager): int
     {
         $ahead = max(1, (int) $this->option('ahead'));
         $now = Carbon::now()->startOfMonth();
@@ -47,27 +40,17 @@ class PartitionsCreateMonths extends Command
 
         for ($i = 0; $i <= $ahead; $i++) {
             $monthStart = $now->copy()->addMonths($i);
-            $monthEnd = $monthStart->copy()->addMonth();
 
-            foreach (self::PARTITIONED_TABLES as $table) {
+            foreach (MonthlyPartitionManager::PARTITIONED_TABLES as $table) {
                 $partitionName = sprintf('%s_%s', $table, $monthStart->format('Y_m'));
 
-                if ($this->partitionExists($partitionName)) {
+                if ($manager->ensureMonth($table, $monthStart)) {
+                    $created++;
+                    $this->info("  create <fg=green>{$partitionName}</>");
+                } else {
                     $skipped++;
                     $this->line("  skip   <fg=gray>{$partitionName}</> (already exists)");
-
-                    continue;
                 }
-
-                DB::statement(sprintf(
-                    "CREATE TABLE %s PARTITION OF %s FOR VALUES FROM ('%s') TO ('%s')",
-                    $partitionName,
-                    $table,
-                    $monthStart->format('Y-m-d'),
-                    $monthEnd->format('Y-m-d'),
-                ));
-                $created++;
-                $this->info("  create <fg=green>{$partitionName}</> [{$monthStart->format('Y-m-d')} → {$monthEnd->format('Y-m-d')})");
             }
         }
 
@@ -76,17 +59,4 @@ class PartitionsCreateMonths extends Command
 
         return self::SUCCESS;
     }
-
-    /**
-     * Проверка существования партиции через pg_class (быстрее information_schema).
-     */
-    private function partitionExists(string $name): bool
-    {
-        $row = DB::selectOne(
-            "SELECT 1 AS exists FROM pg_class WHERE relname = ? AND relkind = 'r'",
-            [$name],
-        );
-
-        return $row !== null;
-    }
 }

app/app/Http/Controllers/Api/AdminBillingController.php

@@ -4,7 +4,10 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api;
 
+use App\Http\Controllers\Concerns\ResolvesAdminUserId;
 use App\Http\Controllers\Controller;
+use App\Models\BalanceTransaction;
+use App\Models\SaasAdminAuditLog;
 use Carbon\CarbonImmutable;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -19,6 +22,183 @@ use Illuminate\Support\Facades\DB;
  */
 class AdminBillingController extends Controller
 {
+    use ResolvesAdminUserId;
+
+    /** GET /api/admin/billing/tariff-plans — список планов для диалога смены тарифа. */
+    public function tariffPlans(): JsonResponse
+    {
+        $plans = DB::table('tariff_plans')
+            ->select(['id', 'name', 'price_monthly'])
+            ->orderBy('price_monthly')
+            ->get()
+            ->map(fn ($p) => [
+                'id' => (int) $p->id,
+                'name' => $p->name,
+                'price_monthly' => (string) $p->price_monthly,
+            ]);
+
+        return response()->json(['plans' => $plans]);
+    }
+
+    /** PATCH /api/admin/billing/tenants/{id}/status — приостановить/разблокировать тенанта. */
+    public function updateStatus(Request $request, int $id): JsonResponse
+    {
+        $validated = $request->validate([
+            'status' => ['required', 'in:active,suspended'],
+            'reason' => ['required', 'string', 'min:10', 'max:1000'],
+        ]);
+
+        $tenant = $this->findActiveTenant($id);
+        $adminUserId = $this->resolveAdminUserId($request, 'system-billing@liderra.local', 'System Billing Bot');
+
+        DB::transaction(function () use ($tenant, $validated, $adminUserId, $request): void {
+            // tenants / saas_admin_audit_log не под RLS — SET LOCAL не нужен (ср. refund()).
+            DB::table('tenants')->where('id', $tenant->id)->update([
+                'status' => $validated['status'],
+                'updated_at' => now(),
+            ]);
+
+            SaasAdminAuditLog::create([
+                'admin_user_id' => $adminUserId,
+                'action' => $validated['status'] === 'suspended' ? 'tenant.suspend' : 'tenant.activate',
+                'target_type' => 'tenant',
+                'target_id' => $tenant->id,
+                'target_tenant_id' => $tenant->id,
+                'payload_before' => ['status' => $tenant->status],
+                'payload_after' => ['status' => $validated['status']],
+                'reason' => $validated['reason'],
+                'ip_address' => $request->ip() ?? '127.0.0.1',
+                'user_agent' => $request->userAgent(),
+            ]);
+        });
+
+        return response()->json(['id' => $tenant->id, 'status' => $validated['status']]);
+    }
+
+    /** POST /api/admin/billing/tenants/{id}/refund — возврат средств: списание с баланса + ledger-запись. */
+    public function refund(Request $request, int $id): JsonResponse
+    {
+        $validated = $request->validate([
+            'amount_rub' => ['required', 'numeric', 'gt:0'],
+            'reason' => ['required', 'string', 'min:10', 'max:1000'],
+        ]);
+
+        $this->findActiveTenant($id); // ранний 404; авторитетный баланс перечитывается под локом ниже
+        $amount = number_format((float) $validated['amount_rub'], 2, '.', '');
+        $adminUserId = $this->resolveAdminUserId($request, 'system-billing@liderra.local', 'System Billing Bot');
+
+        /** @var array{transaction_id:int, balance_rub:string} $result */
+        $result = DB::transaction(function () use ($id, $amount, $validated, $adminUserId, $request): array {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$id);
+
+            // Баланс — money-колонка: перечитываем под row-lock внутри транзакции,
+            // защита от lost-update (конвенция LedgerService — lockForUpdate на tenants).
+            $tenant = DB::table('tenants')->where('id', $id)->whereNull('deleted_at')
+                ->lockForUpdate()->first();
+            if ($tenant === null) {
+                abort(404, 'tenant not found');
+            }
+
+            $balance = (string) $tenant->balance_rub;
+            if (bccomp($amount, $balance, 2) === 1) {
+                abort(422, 'refund amount exceeds tenant balance');
+            }
+            $newBalance = bcsub($balance, $amount, 2);
+
+            DB::table('tenants')->where('id', $id)->update([
+                'balance_rub' => $newBalance,
+                'updated_at' => now(),
+            ]);
+
+            $tx = BalanceTransaction::create([
+                'tenant_id' => $id,
+                'type' => BalanceTransaction::TYPE_REFUND,
+                'amount_rub' => '-'.$amount,
+                'amount_leads' => 0,
+                'balance_rub_after' => $newBalance,
+                'description' => $validated['reason'],
+                'admin_user_id' => $adminUserId,
+                'created_at' => now(),
+            ]);
+
+            SaasAdminAuditLog::create([
+                'admin_user_id' => $adminUserId,
+                'action' => 'tenant.refund',
+                'target_type' => 'tenant',
+                'target_id' => $id,
+                'target_tenant_id' => $id,
+                'payload_before' => ['balance_rub' => $balance],
+                'payload_after' => ['balance_rub' => $newBalance, 'amount_rub' => $amount, 'transaction_id' => $tx->id],
+                'reason' => $validated['reason'],
+                'ip_address' => $request->ip() ?? '127.0.0.1',
+                'user_agent' => $request->userAgent(),
+            ]);
+
+            return ['transaction_id' => (int) $tx->id, 'balance_rub' => $newBalance];
+        });
+
+        return response()->json([
+            'id' => $id,
+            'balance_rub' => $result['balance_rub'],
+            'transaction_id' => $result['transaction_id'],
+        ]);
+    }
+
+    /** PATCH /api/admin/billing/tenants/{id}/tariff — сменить тарифный план тенанта. */
+    public function changeTariff(Request $request, int $id): JsonResponse
+    {
+        $validated = $request->validate([
+            'tariff_id' => ['required', 'integer', 'exists:tariff_plans,id'],
+            'reason' => ['required', 'string', 'min:10', 'max:1000'],
+        ]);
+
+        $tenant = $this->findActiveTenant($id);
+        $tariff = DB::table('tariff_plans')->where('id', $validated['tariff_id'])->first();
+        $adminUserId = $this->resolveAdminUserId($request, 'system-billing@liderra.local', 'System Billing Bot');
+
+        DB::transaction(function () use ($tenant, $tariff, $validated, $adminUserId, $request): void {
+            // tenants / saas_admin_audit_log не под RLS — SET LOCAL не нужен (ср. refund()).
+            DB::table('tenants')->where('id', $tenant->id)->update([
+                'current_tariff_id' => $tariff->id,
+                'updated_at' => now(),
+            ]);
+
+            SaasAdminAuditLog::create([
+                'admin_user_id' => $adminUserId,
+                'action' => 'tenant.change_tariff',
+                'target_type' => 'tenant',
+                'target_id' => $tenant->id,
+                'target_tenant_id' => $tenant->id,
+                'payload_before' => ['current_tariff_id' => $tenant->current_tariff_id],
+                'payload_after' => ['current_tariff_id' => (int) $tariff->id],
+                'reason' => $validated['reason'],
+                'ip_address' => $request->ip() ?? '127.0.0.1',
+                'user_agent' => $request->userAgent(),
+            ]);
+        });
+
+        return response()->json([
+            'id' => $tenant->id,
+            'tariff_id' => (int) $tariff->id,
+            'tariff_name' => $tariff->name,
+        ]);
+    }
+
+    /**
+     * Возвращает не-удалённого тенанта либо abort(404).
+     *
+     * @return object{id:int,status:string,balance_rub:string,current_tariff_id:int|null}
+     */
+    private function findActiveTenant(int $id): object
+    {
+        $tenant = DB::table('tenants')->where('id', $id)->whereNull('deleted_at')->first();
+        if ($tenant === null) {
+            abort(404, 'tenant not found');
+        }
+
+        return $tenant;
+    }
+
     /** GET /api/admin/billing?search= */
     public function index(Request $request): JsonResponse
     {

app/app/Http/Controllers/Api/AdminIncidentsController.php

@@ -4,7 +4,9 @@ declare(strict_types=1);
 
 namespace App\Http\Controllers\Api;
 
+use App\Http\Controllers\Concerns\ResolvesAdminUserId;
 use App\Http\Controllers\Controller;
+use App\Models\SaasAdminAuditLog;
 use Carbon\CarbonImmutable;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -21,6 +23,8 @@ use Illuminate\Support\Facades\DB;
  */
 class AdminIncidentsController extends Controller
 {
+    use ResolvesAdminUserId;
+
     /** GET /api/admin/incidents?type=&severity=&unresolved_only=&limit=&offset= */
     public function index(Request $request): JsonResponse
     {
@@ -83,6 +87,116 @@ class AdminIncidentsController extends Controller
         ]);
     }
 
+    /** POST /api/admin/incidents/{id}/rkn-notify — зафиксировать уведомление РКН (G6, 152-ФЗ). */
+    public function notifyRkn(Request $request, int $id): JsonResponse
+    {
+        $row = DB::table('incidents_log')->where('id', $id)->first();
+        if ($row === null) {
+            abort(404, 'incident not found');
+        }
+        if ($row->type !== 'data_breach') {
+            abort(422, 'РКН-уведомление применимо только к инцидентам типа data_breach');
+        }
+        if ($row->rkn_notified_at !== null) {
+            abort(409, 'РКН уже уведомлён по этому инциденту');
+        }
+
+        $adminUserId = $this->resolveAdminUserId($request, 'system-incidents@liderra.local', 'System Incidents Bot');
+
+        DB::transaction(function () use ($row, $adminUserId, $request): void {
+            DB::table('incidents_log')->where('id', $row->id)->update([
+                'rkn_notified_at' => now(),
+                'updated_at' => now(),
+            ]);
+
+            SaasAdminAuditLog::create([
+                'admin_user_id' => $adminUserId,
+                'action' => 'incident.rkn_notify',
+                'target_type' => 'incident',
+                'target_id' => $row->id,
+                'payload_before' => ['rkn_notified_at' => null],
+                'payload_after' => ['rkn_notified_at' => now()->toIso8601String()],
+                'reason' => 'Роскомнадзор уведомлён об утечке ПДн через админ-интерфейс (152-ФЗ).',
+                'ip_address' => $request->ip() ?? '127.0.0.1',
+                'user_agent' => $request->userAgent(),
+            ]);
+        });
+
+        return $this->show($id);
+    }
+
+    /** GET /api/admin/incidents/{id} — полная карточка инцидента (drill-down G5). */
+    public function show(int $id): JsonResponse
+    {
+        $row = DB::table('incidents_log')->where('id', $id)->first();
+        if ($row === null) {
+            abort(404, 'incident not found');
+        }
+
+        $tenantIds = is_array($row->affected_tenant_ids)
+            ? $row->affected_tenant_ids
+            : ($row->affected_tenant_ids !== null ? $this->parsePgArrayValues((string) $row->affected_tenant_ids) : []);
+
+        $tenants = $tenantIds === []
+            ? collect()
+            : DB::table('tenants')->whereIn('id', $tenantIds)
+                ->select(['id', 'organization_name'])->get();
+
+        $admins = DB::table('saas_admin_users')
+            ->whereIn('id', array_filter([$row->created_by_admin_id, $row->closed_by_admin_id]))
+            ->pluck('full_name', 'id');
+
+        return response()->json([
+            'incident' => [
+                'id' => (int) $row->id,
+                'incident_id' => $this->formatIncidentId($row),
+                'type' => $row->type,
+                'severity' => $row->severity,
+                'summary' => $row->summary,
+                'root_cause' => $row->root_cause,
+                'postmortem_url' => $row->postmortem_url,
+                'started_at' => CarbonImmutable::parse($row->started_at)->toIso8601String(),
+                'detected_at' => CarbonImmutable::parse($row->detected_at)->toIso8601String(),
+                'resolved_at' => $row->resolved_at !== null
+                    ? CarbonImmutable::parse($row->resolved_at)->toIso8601String() : null,
+                'status' => $this->deriveStatus($row),
+                'affected_tenants' => $tenants->map(fn ($t) => [
+                    'id' => (int) $t->id,
+                    'organization_name' => $t->organization_name,
+                ])->values(),
+                'affected_users_count' => $row->affected_users_count !== null ? (int) $row->affected_users_count : null,
+                'notification_sent_at' => $row->notification_sent_at !== null
+                    ? CarbonImmutable::parse($row->notification_sent_at)->toIso8601String() : null,
+                'rkn_notified' => $row->rkn_notified_at !== null,
+                'rkn_notified_at' => $row->rkn_notified_at !== null
+                    ? CarbonImmutable::parse($row->rkn_notified_at)->toIso8601String() : null,
+                'rkn_deadline_at' => $row->type === 'data_breach' && $row->rkn_notified_at === null
+                    ? CarbonImmutable::parse($row->detected_at)->addHours(24)->toIso8601String() : null,
+                'created_by_admin' => $admins->get($row->created_by_admin_id),
+                'closed_by_admin' => $row->closed_by_admin_id !== null ? $admins->get($row->closed_by_admin_id) : null,
+                'created_at' => $row->created_at !== null
+                    ? CarbonImmutable::parse($row->created_at)->toIso8601String() : null,
+                'updated_at' => $row->updated_at !== null
+                    ? CarbonImmutable::parse($row->updated_at)->toIso8601String() : null,
+            ],
+        ]);
+    }
+
+    /**
+     * PG-array literal '{1,2,3}' → массив int.
+     *
+     * @return list<int>
+     */
+    private function parsePgArrayValues(string $literal): array
+    {
+        $trimmed = trim($literal, '{}');
+        if ($trimmed === '') {
+            return [];
+        }
+
+        return array_map('intval', explode(',', $trimmed));
+    }
+
     /** Уникальный человеко-читаемый ID: INC-YYYY-MMDD-NNNN, NNNN = id padded. */
     private function formatIncidentId(object $row): string
     {

app/app/Http/Controllers/Api/ApiKeyController.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\ApiKey;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * API-ключи тенанта (audit D2/D3/J5). Endpoints под auth:sanctum + tenant.
+ *
+ * Полный ключ показывается ОДИН раз — в ответе regenerate(). В БД хранится
+ * только bcrypt key_hash + key_prefix (первые 10 символов для UI). У тенанта
+ * поддерживается один активный ключ: regenerate деактивирует прежние.
+ */
+class ApiKeyController extends Controller
+{
+    private const KEY_PREFIX = 'lpkapi_';
+
+    public function index(Request $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+
+        // Defense-in-depth: явный where даже при RLS — в тестах PG superuser BYPASSRLS.
+        $keys = ApiKey::query()
+            ->where('tenant_id', $tenantId)
+            ->where('is_active', true)
+            ->where('expires_at', '>', now())
+            ->orderByDesc('created_at')
+            ->get(['id', 'name', 'key_prefix', 'last_used_at', 'expires_at', 'created_at']);
+
+        return response()->json(['data' => $keys]);
+    }
+
+    public function regenerate(Request $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+        $userId = (int) $request->user()->id;
+
+        // Один активный ключ на тенанта — прежние деактивируются.
+        ApiKey::query()
+            ->where('tenant_id', $tenantId)
+            ->where('is_active', true)
+            ->update(['is_active' => false]);
+
+        $plainKey = self::KEY_PREFIX.Str::random(48);
+
+        $key = ApiKey::query()->create([
+            'tenant_id' => $tenantId,
+            'user_id' => $userId,
+            'name' => 'API-ключ',
+            'key_hash' => Hash::make($plainKey),
+            'key_prefix' => substr($plainKey, 0, 10),
+            'scopes' => ['read'],
+            'expires_at' => now()->addYear(),
+            'is_active' => true,
+            'created_at' => now(),
+        ]);
+
+        return response()->json([
+            'id' => $key->id,
+            'name' => $key->name,
+            'key' => $plainKey,
+            'key_prefix' => $key->key_prefix,
+        ], Response::HTTP_CREATED);
+    }
+}

app/app/Http/Controllers/Api/AuthController.php

@@ -228,6 +228,31 @@ class AuthController extends Controller
         ]);
     }
 
+    /**
+     * PATCH /api/auth/me — обновление профиля текущего пользователя
+     * (имя, фамилия, телефон, тайм-зона). Email менять нельзя (через support).
+     *
+     * Audit J6/D1 (ProfileTab). Зеркалит updateNotificationPreferences:
+     * та же группа auth:sanctum, тот же inline-validate, тот же userResource.
+     */
+    public function updateProfile(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'first_name' => ['required', 'string', 'max:255'],
+            'last_name' => ['required', 'string', 'max:255'],
+            'phone' => ['nullable', 'string', 'max:20'],
+            'timezone' => ['required', 'timezone'],
+        ]);
+
+        /** @var User $user */
+        $user = $request->user();
+        $user->update($validated);
+
+        return response()->json([
+            'user' => $this->userResource($user->fresh()),
+        ]);
+    }
+
     /**
      * Ключ throttle для login: email|ip — защищает email от брутфорса даже
      * за NAT'ом, и IP от перебора емейлов с одного источника.
@@ -333,6 +358,8 @@ class AuthController extends Controller
             'email' => $user->email,
             'first_name' => $user->first_name,
             'last_name' => $user->last_name,
+            'phone' => $user->phone,
+            'timezone' => $user->timezone,
             'tenant_id' => $user->tenant_id,
             'totp_enabled' => $user->totp_enabled,
             'last_login_at' => $user->last_login_at,

app/app/Http/Controllers/Api/BillingController.php

@@ -0,0 +1,186 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\BalanceTransaction;
+use App\Models\Tenant;
+use App\Models\User;
+use App\Services\Billing\BillingTopupService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Биллинг тенанта — кошелёк, транзакции, счета, пополнение (audit E1/E3).
+ *
+ * Все эндпоинты под middleware [auth:sanctum, tenant] (RLS-контекст).
+ * Отдельно от TenantChargesController (lead_charges ledger) и
+ * AdminBillingController (SaaS-уровневые агрегаты).
+ *
+ * E1: POST /api/billing/topup — MVP-stub пополнения (без платёжного шлюза).
+ * E3: GET wallet/transactions/invoices — данные для BillingView Overview.
+ */
+class BillingController extends Controller
+{
+    public function __construct(
+        private readonly BillingTopupService $topupService,
+    ) {}
+
+    /**
+     * POST /api/billing/topup — пополнить рублёвый баланс.
+     *
+     * MVP-stub: кредитует баланс немедленно (без ЮKassa — реальная оплата
+     * post-Б-1). Записывает append-only строку balance_transactions(topup).
+     */
+    public function topup(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'amount_rub' => ['required', 'numeric', 'min:100', 'max:1000000', 'decimal:0,2'],
+        ]);
+
+        /** @var User $user */
+        $user = $request->user();
+
+        // Нормализуем в DECIMAL-строку scale 2 для bcmath (НЕ float).
+        $amountRub = bcadd((string) $validated['amount_rub'], '0', 2);
+
+        $tx = $this->topupService->topup((int) $user->tenant_id, $amountRub, (int) $user->id);
+
+        return response()->json([
+            'transaction' => [
+                'id' => $tx->id,
+                'type' => $tx->type,
+                'amount_rub' => $tx->amount_rub,
+                'balance_rub_after' => $tx->balance_rub_after,
+                'created_at' => $tx->created_at,
+            ],
+            'balance_rub' => $tx->balance_rub_after,
+        ], 201);
+    }
+
+    /**
+     * GET /api/billing/wallet — балансы тенанта + текущий тариф + runway.
+     */
+    public function wallet(Request $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = $request->user();
+        /** @var Tenant $tenant */
+        $tenant = Tenant::query()->with('tariff')->findOrFail((int) $user->tenant_id);
+
+        return response()->json([
+            'balance_rub' => $tenant->balance_rub,
+            'balance_leads' => $tenant->balance_leads,
+            'runway_days' => $this->runwayDays($tenant),
+            'tariff' => $tenant->tariff === null ? null : [
+                'code' => $tenant->tariff->code,
+                'name' => $tenant->tariff->name,
+                'price_monthly' => $tenant->tariff->price_monthly,
+                'billing_model' => $tenant->tariff->billing_model,
+                'features' => $tenant->tariff->features ?? [],
+            ],
+        ]);
+    }
+
+    /**
+     * GET /api/billing/transactions?type=topup|lead_charge|refund&page=N
+     * — пагинированная история balance_transactions тенанта (20/страница).
+     */
+    public function transactions(Request $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = $request->user();
+        $tenantId = (int) $user->tenant_id;
+
+        // Явный tenant_id фильтр — defense-in-depth поверх RLS (тесты идут
+        // под superuser BYPASSRLS; паттерн TenantChargesController).
+        $query = BalanceTransaction::query()
+            ->where('tenant_id', $tenantId)
+            ->orderBy('created_at', 'desc')
+            ->orderBy('id', 'desc');
+
+        $type = $request->query('type');
+        if (is_string($type) && in_array($type, ['topup', 'lead_charge', 'refund'], true)) {
+            $query->where('type', $type);
+        }
+
+        $page = $query->paginate(20);
+
+        return response()->json([
+            'data' => array_map(static fn (BalanceTransaction $tx): array => [
+                'id' => $tx->id,
+                'code' => 'TX-'.$tx->id,
+                'type' => $tx->type,
+                'description' => $tx->description,
+                'amount_rub' => $tx->amount_rub,
+                'amount_leads' => $tx->amount_leads,
+                'balance_rub_after' => $tx->balance_rub_after,
+                'created_at' => $tx->created_at,
+            ], $page->items()),
+            'meta' => [
+                'current_page' => $page->currentPage(),
+                'last_page' => $page->lastPage(),
+                'total' => $page->total(),
+                'per_page' => $page->perPage(),
+            ],
+        ]);
+    }
+
+    /**
+     * GET /api/billing/invoices — счета тенанта (saas_invoices).
+     *
+     * Real-but-empty на MVP: saas_invoices.legal_entity_id NOT NULL требует
+     * зарегистрированного юр-лица (блокируется Б-1). Read-only выборка через
+     * DB::table — без Eloquent-модели (паттерн AdminBillingController).
+     */
+    public function invoices(Request $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = $request->user();
+        $tenantId = (int) $user->tenant_id;
+
+        $rows = DB::table('saas_invoices')
+            ->where('tenant_id', $tenantId)
+            ->orderBy('issued_at', 'desc')
+            ->get(['id', 'invoice_number', 'amount_total', 'status', 'issued_at', 'pdf_path']);
+
+        return response()->json([
+            'data' => $rows->map(static fn (\stdClass $r): array => [
+                'id' => $r->id,
+                'invoice_number' => $r->invoice_number,
+                'amount_total' => $r->amount_total,
+                'status' => $r->status,
+                'issued_at' => $r->issued_at,
+                'has_pdf' => $r->pdf_path !== null,
+            ])->all(),
+        ]);
+    }
+
+    /**
+     * Прогноз «на сколько дней хватит баланса» — оценочный UX-показатель.
+     *
+     * = balance_rub / (рублёвые списания за 30 дней / 30). NULL, если списаний
+     * не было. Float здесь допустим: грубая оценка для шапки, НЕ мутация
+     * баланса (мутации баланса — строго bcmath, см. BillingTopupService).
+     * Отрицательный баланс → 0 (тенант уже в минусе, runway не может быть < 0).
+     */
+    private function runwayDays(Tenant $tenant): ?int
+    {
+        $spent = abs((float) DB::table('balance_transactions')
+            ->where('tenant_id', $tenant->id)
+            ->where('type', BalanceTransaction::TYPE_LEAD_CHARGE)
+            ->where('created_at', '>=', now()->subDays(30))
+            ->sum('amount_rub'));
+
+        if ($spent <= 0.0) {
+            return null;
+        }
+
+        $perDay = $spent / 30.0;
+
+        return max(0, (int) floor((float) $tenant->balance_rub / $perDay));
+    }
+}

app/app/Http/Controllers/Api/DashboardController.php

@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Tenant;
+use Carbon\CarbonImmutable;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Дашборд — агрегат для DashboardView (audit C1/J3).
+ *
+ * GET /api/dashboard/summary?tenant_id={id}&range=today|7d|30d
+ *
+ * На MVP без auth-middleware (tenant_id параметром, как DealController).
+ * Production: middleware('auth:sanctum','tenant') → tenant_id из user.
+ *
+ * Все агрегаты — tenant-scoped, deleted_at IS NULL, is_test=false.
+ * RLS-обёртка SET LOCAL app.current_tenant_id (PgBouncer-safe), как DealController.
+ */
+class DashboardController extends Controller
+{
+    private const RU_WEEKDAYS = ['вс', 'пн', 'вт', 'ср', 'чт', 'пт', 'сб'];
+
+    public function summary(Request $request): JsonResponse
+    {
+        $tenantId = (int) $request->query('tenant_id', '0');
+        if ($tenantId < 1) {
+            return response()->json(['message' => 'Параметр tenant_id обязателен.'], 422);
+        }
+
+        $tenant = Tenant::find($tenantId);
+        if ($tenant === null) {
+            return response()->json(['message' => 'Тенант не найден.'], 404);
+        }
+
+        $range = in_array($request->query('range'), ['today', '7d', '30d'], true)
+            ? (string) $request->query('range')
+            : '7d';
+
+        // MSK: activity-бакеты и range-границы должны совпадать с SQL
+        // `AT TIME ZONE 'Europe/Moscow'`. config('app.timezone') = UTC.
+        $now = CarbonImmutable::now('Europe/Moscow');
+        [$windowStart, $prevStart] = match ($range) {
+            'today' => [$now->startOfDay(), $now->startOfDay()->subDay()],
+            '30d' => [$now->subDays(30), $now->subDays(60)],
+            default => [$now->subDays(7), $now->subDays(14)],
+        };
+
+        $data = DB::transaction(function () use ($tenantId, $tenant, $now, $range, $windowStart, $prevStart) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            $base = fn () => DB::table('deals')
+                ->where('tenant_id', $tenantId)
+                ->whereNull('deleted_at')
+                ->where('is_test', false);
+
+            // --- leads received: текущее + предыдущее окно ---
+            $curLeads = (clone $base())->whereBetween('received_at', [$windowStart, $now])->count();
+            $prevLeads = (clone $base())->whereBetween('received_at', [$prevStart, $windowStart])->count();
+
+            // --- conversion: % статуса 'paid' в окне ---
+            $curPaid = (clone $base())->where('status', 'paid')
+                ->whereBetween('received_at', [$windowStart, $now])->count();
+            $prevPaid = (clone $base())->where('status', 'paid')
+                ->whereBetween('received_at', [$prevStart, $windowStart])->count();
+            $curConv = $curLeads > 0 ? round($curPaid / $curLeads * 100, 1) : 0.0;
+            $prevConv = $prevLeads > 0 ? round($prevPaid / $prevLeads * 100, 1) : 0.0;
+
+            // --- active projects ---
+            $activeProjects = DB::table('projects')
+                ->where('tenant_id', $tenantId)
+                ->whereNull('archived_at')
+                ->where('is_active', true)
+                ->count();
+            $maxProjects = (int) (($tenant->limits['max_projects'] ?? 0));
+
+            // --- activity: 7 daily-бакетов по received_at (MSK) ---
+            $activityStart = $now->subDays(6)->startOfDay();
+            $byDay = (clone $base())
+                ->where('received_at', '>=', $activityStart)
+                ->selectRaw("to_char((received_at AT TIME ZONE 'Europe/Moscow')::date, 'YYYY-MM-DD') AS d, COUNT(*) AS c")
+                ->groupBy('d')
+                ->pluck('c', 'd');
+            $points = [];
+            $labels = [];
+            for ($i = 6; $i >= 0; $i--) {
+                $day = $now->subDays($i);
+                $key = $day->format('Y-m-d');
+                $points[] = (int) ($byDay[$key] ?? 0);
+                $labels[] = $i === 0 ? 'сегодня' : self::RU_WEEKDAYS[(int) $day->format('w')];
+            }
+            $maxPoint = max(0, ...$points);
+            $axisMax = max(10, (int) (ceil($maxPoint / 10) * 10));
+
+            // --- funnel: текущий снимок по статусам ---
+            $funnel = (clone $base())
+                ->selectRaw('status, COUNT(*) AS c')
+                ->groupBy('status')
+                ->pluck('c', 'status')
+                ->map(fn ($c) => (int) $c)
+                ->toArray();
+
+            // --- runway ---
+            // runway опирается на приток за фиксированное 7-дневное окно,
+            // независимо от выбранного range (для today/30d $curLeads — не 7-дневный).
+            $leads7d = (clone $base())->whereBetween('received_at', [$now->subDays(7), $now])->count();
+            $avgDaily = $leads7d / 7.0;
+            $balanceLeads = (int) ($tenant->balance_leads ?? 0);
+            $runwayDays = $avgDaily > 0 ? (int) floor($balanceLeads / $avgDaily) : 0;
+
+            return [
+                'range' => $range,
+                'leads_received' => self::deltaBlock($curLeads, $prevLeads, 'delta_pct', self::pctDelta($curLeads, $prevLeads)),
+                'conversion' => self::deltaBlock($curConv, $prevConv, 'delta_pp', round($curConv - $prevConv, 1)),
+                'active_projects' => ['active' => $activeProjects, 'limit' => $maxProjects],
+                'balance' => [
+                    'amount_rub' => (string) $tenant->balance_rub,
+                    'runway_days' => $runwayDays,
+                    'runway_leads' => $balanceLeads,
+                ],
+                'activity' => ['points' => $points, 'labels' => $labels, 'max' => $axisMax],
+                'funnel' => (object) $funnel,
+            ];
+        });
+
+        return response()->json($data);
+    }
+
+    /** Процентная дельта current vs previous; 0.0 если previous=0. */
+    private static function pctDelta(float $cur, float $prev): float
+    {
+        return $prev > 0 ? round(($cur - $prev) / $prev * 100, 1) : 0.0;
+    }
+
+    /** Блок {value, <deltaKey>, delta_dir}. */
+    private static function deltaBlock(float $value, float $prev, string $deltaKey, float $delta): array
+    {
+        $dir = $value > $prev ? 'up' : ($value < $prev ? 'down' : 'neutral');
+
+        return ['value' => $value, $deltaKey => $delta, 'delta_dir' => $dir];
+    }
+}

app/app/Http/Controllers/Api/DealBulkActionController.php

@@ -7,7 +7,6 @@ namespace App\Http\Controllers\Api;
 use App\Http\Controllers\Controller;
 use App\Models\ActivityLog;
 use App\Models\Deal;
-use App\Models\Tenant;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -20,6 +19,8 @@ use Illuminate\Support\Facades\DB;
  * bulk + export + helpers). Этот класс отвечает только за многоразовые
  * массовые операции; single-resource действия остаются в DealController.
  *
+ * J1 (Sprint 3F): auth:sanctum+tenant, tenant_id из auth()->user().
+ *
  * O-perf-01: N+1 устранён.
  *
  *   transition: сначала SELECT всех сделок tenant'а из ids, чтобы отфильтровать
@@ -41,23 +42,19 @@ class DealBulkActionController extends Controller
     /**
      * POST /api/deals/transition — bulk status-update.
      *
-     * Body: {tenant_id, ids: [int...], status: slug}.
+     * Body: {ids: [int...], status: slug}.
      * Response: {updated, requested, status} (updated = реально изменённых,
      * без NO-OP).
      */
     public function transition(Request $request): JsonResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'ids' => 'required|array|min:1|max:1000',
             'ids.*' => 'integer|min:1',
             'status' => 'required|string|max:50',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         $statusExists = DB::table('lead_statuses')->where('slug', $validated['status'])->exists();
         if (! $statusExists) {
@@ -67,14 +64,14 @@ class DealBulkActionController extends Controller
             ], 422);
         }
 
-        $updated = DB::transaction(function () use ($validated, $tenant) {
-            DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+        $updated = DB::transaction(function () use ($validated, $tenantId) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             // Фаза 1: SELECT — нужны id и предыдущий status для каждой строки,
             // чтобы (а) отфильтровать NO-OP и (б) сохранить prev в context.from.
             // Defense-in-depth where(tenant_id) — защита от кросс-tenant id.
             $rows = Deal::query()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $validated['ids'])
                 ->get(['id', 'status']);
 
@@ -88,7 +85,7 @@ class DealBulkActionController extends Controller
 
             // Фаза 2: bulk-UPDATE 1 запросом вместо N.
             Deal::query()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $changedIds)
                 ->update([
                     'status' => $validated['status'],
@@ -100,7 +97,7 @@ class DealBulkActionController extends Controller
             // массив сериализуем в JSON руками, остальные scalar-поля передаём
             // напрямую. Триггер audit_chain_hash() заполнит log_hash на уровне БД.
             $logRows = $changed->map(fn (Deal $d) => [
-                'tenant_id' => $tenant->id,
+                'tenant_id' => $tenantId,
                 'user_id' => null,
                 'deal_id' => $d->id,
                 'event' => ActivityLog::EVENT_DEAL_STATUS_CHANGED,
@@ -127,7 +124,7 @@ class DealBulkActionController extends Controller
     /**
      * DELETE /api/deals — bulk soft-delete.
      *
-     * Body: {tenant_id, ids: [int...]}.
+     * Body: {ids: [int...]}.
      * Response: {deleted, requested}.
      *
      * Soft-delete сохраняется (см. документацию в DealController.destroy на
@@ -137,23 +134,19 @@ class DealBulkActionController extends Controller
     public function destroy(Request $request): JsonResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'ids' => 'required|array|min:1|max:1000',
             'ids.*' => 'integer|min:1',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
-        $deleted = DB::transaction(function () use ($validated, $tenant) {
-            DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+        $deleted = DB::transaction(function () use ($validated, $tenantId) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             // SELECT id'шников живых сделок tenant'а из ids — для bulk-INSERT
             // в activity_log по списку реально удаляемых (NO-OP idempotency).
             $targetIds = Deal::query()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $validated['ids'])
                 ->whereNull('deleted_at')
                 ->pluck('id')
@@ -166,7 +159,7 @@ class DealBulkActionController extends Controller
             $now = now();
 
             Deal::query()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $targetIds)
                 ->whereNull('deleted_at')
                 ->update([
@@ -175,7 +168,7 @@ class DealBulkActionController extends Controller
                 ]);
 
             $logRows = array_map(fn (int $id) => [
-                'tenant_id' => $tenant->id,
+                'tenant_id' => $tenantId,
                 'user_id' => null,
                 'deal_id' => $id,
                 'event' => ActivityLog::EVENT_DEAL_DELETED,
@@ -197,30 +190,26 @@ class DealBulkActionController extends Controller
     /**
      * POST /api/deals/restore — bulk restore soft-deleted.
      *
-     * Body: {tenant_id, ids: [int...]}.
+     * Body: {ids: [int...]}.
      * Response: {restored, requested}.
      */
     public function restore(Request $request): JsonResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'ids' => 'required|array|min:1|max:1000',
             'ids.*' => 'integer|min:1',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
-        $restored = DB::transaction(function () use ($validated, $tenant) {
-            DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+        $restored = DB::transaction(function () use ($validated, $tenantId) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             // withTrashed обходит SoftDeletes global scope; whereNotNull —
             // NO-OP idempotency для уже живых.
             $targetIds = Deal::query()
                 ->withTrashed()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $validated['ids'])
                 ->whereNotNull('deleted_at')
                 ->pluck('id')
@@ -234,7 +223,7 @@ class DealBulkActionController extends Controller
 
             Deal::query()
                 ->withTrashed()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereIn('id', $targetIds)
                 ->whereNotNull('deleted_at')
                 ->update([
@@ -243,7 +232,7 @@ class DealBulkActionController extends Controller
                 ]);
 
             $logRows = array_map(fn (int $id) => [
-                'tenant_id' => $tenant->id,
+                'tenant_id' => $tenantId,
                 'user_id' => null,
                 'deal_id' => $id,
                 'event' => ActivityLog::EVENT_DEAL_RESTORED,

app/app/Http/Controllers/Api/DealController.php

@@ -9,7 +9,6 @@ use App\Models\ActivityLog;
 use App\Models\Deal;
 use App\Models\Project;
 use App\Models\SupplierLeadCost;
-use App\Models\Tenant;
 use App\Models\User;
 use App\Services\SupplierResolver;
 use Illuminate\Http\JsonResponse;
@@ -27,9 +26,7 @@ use Illuminate\Support\Facades\DB;
  * `WebhookReceiveController` + `ProcessWebhookJob` (асинхронно через очередь
  * с advisory lock + dedup). Этот controller — для ручных action'ов из UI.
  *
- * На MVP без auth-middleware (multi-tenant контекст резолвится по
- * `tenant_id` параметру). Production: middleware('auth:sanctum')+'tenant'
- * → tenant_id из request()->user()->tenant_id; user ID для manager/audit.
+ * J1 (Sprint 3F): auth:sanctum+tenant, tenant_id из auth()->user().
  *
  * Manual-create отличается от webhook'а:
  *   - source_crm_id = NULL (не из webhook).
@@ -42,7 +39,7 @@ use Illuminate\Support\Facades\DB;
 class DealController extends Controller
 {
     /**
-     * GET /api/deals?tenant_id={id}&status_in[]=...&project_id=...&manager_id=...&search=...&limit=...&offset=...
+     * GET /api/deals?status_in[]=...&project_id=...&manager_id=...&search=...&limit=...&offset=...
      *
      * Список сделок tenant'а с relations (project.name, manager.first/last/email).
      * Используется в `DealsView`/`KanbanView` вместо MOCK_DEALS.
@@ -53,20 +50,10 @@ class DealController extends Controller
      * (received_at, id)).
      *
      * RLS: SET LOCAL app.current_tenant_id внутри транзакции (PgBouncer-safe).
-     * Чужие сделки отфильтрует политика, даже если клиент подсунет чужой
-     * tenant_id (без auth — на MVP, на prod — middleware).
      */
     public function index(Request $request): JsonResponse
     {
-        $tenantId = (int) $request->query('tenant_id', '0');
-        if ($tenantId < 1) {
-            return response()->json(['message' => 'Параметр tenant_id обязателен.'], 422);
-        }
-
-        $tenant = Tenant::find($tenantId);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         $statuses = (array) $request->query('status_in', []);
         $projectId = $request->query('project_id') !== null ? (int) $request->query('project_id') : null;
@@ -75,6 +62,7 @@ class DealController extends Controller
         $limit = max(1, min(500, (int) $request->query('limit', '100')));
         $offset = max(0, (int) $request->query('offset', '0'));
         $onlyDeleted = $request->boolean('only_deleted');
+        $countOnly = $request->boolean('count_only');
         $cursorRaw = (string) $request->query('cursor', '');
 
         // Sprint 4 Phase A (audit O-perf-04): keyset pagination через cursor.
@@ -93,7 +81,7 @@ class DealController extends Controller
             $cursor = ['r' => (string) $parsed['r'], 'i' => (int) $parsed['i']];
         }
 
-        [$deals, $total, $nextCursor] = DB::transaction(function () use ($tenantId, $statuses, $projectId, $managerId, $search, $limit, $offset, $onlyDeleted, $cursor) {
+        [$deals, $total, $nextCursor] = DB::transaction(function () use ($tenantId, $statuses, $projectId, $managerId, $search, $limit, $offset, $onlyDeleted, $cursor, $countOnly) {
             DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             // Defense-in-depth: явный where(tenant_id) поверх RLS — на тестах
@@ -128,6 +116,12 @@ class DealController extends Controller
                 });
             }
 
+            // Audit B2: count_only — отдаём только COUNT(*), пропуская SELECT строк
+            // и cursor/offset-логику (лёгкий запрос для бейджа в сайдбаре).
+            if ($countOnly) {
+                return [collect(), $query->count(), null];
+            }
+
             if ($cursor !== null) {
                 // Keyset: PG row constructor через индекс на (received_at DESC, id DESC).
                 // Не считаем total (дорого без COUNT(*); клиент при необходимости
@@ -172,6 +166,10 @@ class DealController extends Controller
             return [$rows, $total, $next];
         });
 
+        if ($countOnly) {
+            return response()->json(['total' => $total]);
+        }
+
         $payload = [
             'deals' => $deals->map(fn (Deal $d) => [
                 'id' => $d->id,
@@ -203,7 +201,7 @@ class DealController extends Controller
     }
 
     /**
-     * GET /api/deals/{id}?tenant_id={id} — детали сделки + recent activity events.
+     * GET /api/deals/{id} — детали сделки + recent activity events.
      *
      * Используется в DealDetailDrawer (правая панель). Возвращает deal с
      * relations + до 50 последних activity_log событий по этой сделке.
@@ -213,15 +211,7 @@ class DealController extends Controller
      */
     public function show(Request $request, int $id): JsonResponse
     {
-        $tenantId = (int) $request->query('tenant_id', '0');
-        if ($tenantId < 1) {
-            return response()->json(['message' => 'Параметр tenant_id обязателен.'], 422);
-        }
-
-        $tenant = Tenant::find($tenantId);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         [$deal, $events] = DB::transaction(function () use ($tenantId, $id) {
             DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
@@ -291,7 +281,7 @@ class DealController extends Controller
     /**
      * PATCH /api/deals/{id} — частичное редактирование сделки из DealDetailDrawer.
      *
-     * Body (все поля optional, должно быть хотя бы одно): {tenant_id, comment?,
+     * Body (все поля optional, должно быть хотя бы одно): {comment?,
      * manager_id?, status?}.
      *
      * Каждое изменение пишется в ActivityLog с правильным event-type:
@@ -309,16 +299,12 @@ class DealController extends Controller
     public function update(Request $request, int $id): JsonResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'comment' => 'nullable|string|max:5000',
             'manager_id' => 'nullable|integer|min:1',
             'status' => 'nullable|string|max:50',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         // Validate status slug если передан.
         if (array_key_exists('status', $validated) && $validated['status'] !== null) {
@@ -335,7 +321,7 @@ class DealController extends Controller
         if (array_key_exists('manager_id', $validated) && $validated['manager_id'] !== null) {
             $managerExists = User::query()
                 ->where('id', $validated['manager_id'])
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereNull('deleted_at')
                 ->where('is_active', true)
                 ->exists();
@@ -347,11 +333,11 @@ class DealController extends Controller
             }
         }
 
-        $deal = DB::transaction(function () use ($validated, $tenant, $id) {
-            DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+        $deal = DB::transaction(function () use ($validated, $tenantId, $id) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             $deal = Deal::query()
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->where('id', $id)
                 ->first();
 
@@ -363,7 +349,7 @@ class DealController extends Controller
             if (array_key_exists('comment', $validated) && $deal->comment !== $validated['comment']) {
                 $deal->comment = $validated['comment'];
                 ActivityLog::create([
-                    'tenant_id' => $tenant->id,
+                    'tenant_id' => $tenantId,
                     'user_id' => null,
                     'deal_id' => $deal->id,
                     'event' => 'deal.commented',
@@ -376,7 +362,7 @@ class DealController extends Controller
                 $deal->manager_id = $validated['manager_id'];
                 $deal->assigned_at = $validated['manager_id'] !== null ? now() : null;
                 ActivityLog::create([
-                    'tenant_id' => $tenant->id,
+                    'tenant_id' => $tenantId,
                     'user_id' => null,
                     'deal_id' => $deal->id,
                     'event' => ActivityLog::EVENT_DEAL_ASSIGNED,
@@ -388,7 +374,7 @@ class DealController extends Controller
                 $previousStatus = $deal->status;
                 $deal->status = $validated['status'];
                 ActivityLog::create([
-                    'tenant_id' => $tenant->id,
+                    'tenant_id' => $tenantId,
                     'user_id' => null,
                     'deal_id' => $deal->id,
                     'event' => ActivityLog::EVENT_DEAL_STATUS_CHANGED,
@@ -425,7 +411,6 @@ class DealController extends Controller
     public function store(Request $request): JsonResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'project_name' => 'required|string|max:255',
             'phone' => 'required|string|max:20',
             'contact_name' => 'nullable|string|max:255',
@@ -434,17 +419,14 @@ class DealController extends Controller
             'comment' => 'nullable|string|max:5000',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            return response()->json(['message' => 'Тенант не найден.'], 404);
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         // Manager FK guard: если manager_id передан, он должен принадлежать
         // этому tenant'у. Иначе можно назначить чужого менеджера на свою сделку.
         if (isset($validated['manager_id'])) {
             $managerExists = User::query()
                 ->where('id', $validated['manager_id'])
-                ->where('tenant_id', $tenant->id)
+                ->where('tenant_id', $tenantId)
                 ->whereNull('deleted_at')
                 ->where('is_active', true)
                 ->exists();
@@ -459,16 +441,16 @@ class DealController extends Controller
         $statusSlug = $validated['status'] ?? 'new';
 
         // Транзакция + RLS: SET LOCAL внутри (PgBouncer-safe).
-        $deal = DB::transaction(function () use ($validated, $tenant, $statusSlug) {
-            DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+        $deal = DB::transaction(function () use ($validated, $tenantId, $statusSlug) {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
             $project = Project::firstOrCreate(
-                ['tenant_id' => $tenant->id, 'name' => $validated['project_name']],
+                ['tenant_id' => $tenantId, 'name' => $validated['project_name']],
                 ['type' => 'manual'],
             );
 
             $deal = Deal::create([
-                'tenant_id' => $tenant->id,
+                'tenant_id' => $tenantId,
                 'source_crm_id' => null, // manual
                 'project_id' => $project->id,
                 'phone' => $validated['phone'],
@@ -499,7 +481,7 @@ class DealController extends Controller
             }
 
             ActivityLog::create([
-                'tenant_id' => $tenant->id,
+                'tenant_id' => $tenantId,
                 'user_id' => null, // на prod — request()->user()->id
                 'deal_id' => $deal->id,
                 'event' => ActivityLog::EVENT_DEAL_CREATED,

app/app/Http/Controllers/Api/DealExportController.php

@@ -6,7 +6,6 @@ namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Models\Deal;
-use App\Models\Tenant;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use OpenSpout\Common\Entity\Row;
@@ -21,13 +20,15 @@ use Symfony\Component\HttpFoundation\StreamedResponse;
  *
  * Извлечено из DealController (Sprint 3 Phase A, audit O-refactor-01).
  *
+ * J1 (Sprint 3F): auth:sanctum+tenant, tenant_id из auth()->user().
+ *
  * O-perf-05: streaming устраняет memory pressure. PhpSpreadsheet строил
  * полный объект .xlsx в памяти (для 10K сделок ≈ 100+ MB). OpenSpout пишет
  * в php://output постранично через Writer + Row::fromValues и chunkById(500)
  * по сделкам — пик памяти O(1) от размера экспорта.
  *
  * API контракт сохранён:
- *   POST /api/deals/export {tenant_id, ids[], format?: csv|xlsx}
+ *   POST /api/deals/export {ids[], format?: csv|xlsx}
  *   Headers Content-Type / Content-Disposition без изменений.
  *   CSV: UTF-8 + BOM + ;-разделитель (Excel-friendly RU-локаль).
  *   XLSX: bold-header + auto-size columns.
@@ -43,16 +44,12 @@ class DealExportController extends Controller
     public function export(Request $request): StreamedResponse
     {
         $validated = $request->validate([
-            'tenant_id' => 'required|integer|min:1',
             'ids' => 'required|array|min:1|max:10000',
             'ids.*' => 'integer|min:1',
             'format' => 'nullable|string|in:csv,xlsx',
         ]);
 
-        $tenant = Tenant::find($validated['tenant_id']);
-        if ($tenant === null) {
-            abort(404, 'Тенант не найден.');
-        }
+        $tenantId = (int) $request->user()->tenant_id;
 
         $format = $validated['format'] ?? 'csv';
         $filename = 'deals_export_'.now()->format('Y-m-d').'.'.$format;
@@ -67,13 +64,13 @@ class DealExportController extends Controller
                 'Content-Disposition' => 'attachment; filename="'.$filename.'"',
             ];
 
-        return new StreamedResponse(function () use ($validated, $tenant, $format) {
+        return new StreamedResponse(function () use ($validated, $tenantId, $format) {
             // RLS-контекст должен быть установлен внутри транзакции на момент
             // фактического SELECT. StreamedResponse callback вызывается уже
             // после Laravel-response pipeline'а, поэтому открываем транзакцию
             // прямо здесь.
-            DB::transaction(function () use ($validated, $tenant, $format) {
-                DB::statement('SET LOCAL app.current_tenant_id = '.$tenant->id);
+            DB::transaction(function () use ($validated, $tenantId, $format) {
+                DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
 
                 $writer = $this->openWriter($format);
                 $writer->openToFile('php://output');
@@ -93,7 +90,7 @@ class DealExportController extends Controller
                 // chunkById(500) — keyset-friendly; в нашем DealsView это
                 // редкий тяжёлый action, экспортировать могут до 10K id.
                 Deal::query()
-                    ->where('tenant_id', $tenant->id)
+                    ->where('tenant_id', $tenantId)
                     ->whereIn('id', $validated['ids'])
                     ->orderBy('id')
                     ->chunkById(500, function ($deals) use ($writer) {

app/app/Http/Controllers/Api/ImpersonationController.php

@@ -123,15 +123,21 @@ class ImpersonationController extends Controller
         ]);
 
         // TODO: отправить email на $tenant->contact_email с $plainCode.
-        // На MVP возвращаем code в response для тестов / dev (на prod НЕ должно
-        // возвращаться никогда — токен только в email клиента).
-        return response()->json([
+        $payload = [
             'token_id' => $token->id,
             'expires_at' => $token->expires_at->toIso8601String(),
             'sent_to_email' => $token->sent_to_email,
-            // dev-only field — на prod исчезает после интеграции с MailService.
-            '_dev_plain_code' => $plainCode,
-        ]);
+        ];
+
+        // Audit-fix A2: plain-код возвращается в API-ответе ТОЛЬКО на dev/testing
+        // (для тестов и локальной разработки). На prod код уходит исключительно
+        // в email клиента — env-guard исключает захват impersonation-сессии
+        // через чтение ответа init.
+        if (app()->environment('local', 'testing')) {
+            $payload['_dev_plain_code'] = $plainCode;
+        }
+
+        return response()->json($payload);
     }
 
     /** POST /api/admin/impersonation/verify */

app/app/Http/Controllers/Api/ImportController.php

@@ -0,0 +1,158 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\ResolveUnknownStatusesRequest;
+use App\Http\Requests\StoreImportRequest;
+use App\Jobs\ImportLeadsJob;
+use App\Models\ImportLog;
+use App\Models\ImportUnknownStatus;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * CSV-импорт исторических лидов из crm.bp-gr.ru (ТЗ §6).
+ *
+ * Все маршруты — под auth:sanctum + tenant (RLS-контекст задан middleware).
+ * tenant_id берётся из авторизованного пользователя, не из запроса.
+ */
+class ImportController extends Controller
+{
+    /**
+     * POST /api/imports — загрузка CSV, создание import_log, dispatch job'а.
+     */
+    public function store(StoreImportRequest $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+        $file = $request->file('file');
+        $storedName = Str::uuid()->toString().'.csv';
+        $path = $file->storeAs("imports/{$tenantId}", $storedName, 'local');
+
+        $log = ImportLog::create([
+            'tenant_id' => $tenantId,
+            'user_id' => $request->user()->id,
+            'filename' => $file->getClientOriginalName(),
+            'file_path' => $path,
+            'status' => 'pending',
+            'entity_type' => 'leads',
+            'source_system' => 'crm.bp-gr.ru',
+            'dry_run' => $request->boolean('dry_run'),
+        ]);
+
+        ImportLeadsJob::dispatch($log->id, $tenantId);
+
+        return response()->json(['data' => $this->toResource($log)], 201);
+    }
+
+    /**
+     * GET /api/imports — история импортов тенанта (RLS отфильтрует по tenant).
+     *
+     * Defense-in-depth: явный where(tenant_id) поверх RLS — на dev через
+     * `postgres` superuser RLS обходится BYPASSRLS, app-фильтр гарантирует
+     * изоляцию (паттерн из DealController).
+     */
+    public function index(Request $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+
+        $logs = ImportLog::query()
+            ->where('tenant_id', $tenantId)
+            ->orderByDesc('id')
+            ->limit(50)
+            ->get()
+            ->map(fn (ImportLog $log) => $this->toResource($log));
+
+        return response()->json(['data' => $logs]);
+    }
+
+    /**
+     * GET /api/imports/{importLog} — прогресс одного импорта (для polling'а).
+     *
+     * Defense-in-depth: явная проверка tenant_id на принадлежность поверх RLS.
+     */
+    public function show(Request $request, ImportLog $importLog): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+
+        abort_if($importLog->tenant_id !== $tenantId, 403, 'Доступ к импорту другого тенанта запрещён.');
+
+        return response()->json(['data' => $this->toResource($importLog)]);
+    }
+
+    /**
+     * GET /api/imports/unknown-statuses — незамапленные статусы (вход wizard'а §6.6).
+     *
+     * Defense-in-depth: явный where(tenant_id) поверх RLS.
+     */
+    public function unknownStatuses(Request $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+
+        $rows = ImportUnknownStatus::query()
+            ->where('tenant_id', $tenantId)
+            ->unresolved()
+            ->orderByDesc('occurrences')
+            ->get()
+            ->map(fn (ImportUnknownStatus $s) => [
+                'id' => $s->id,
+                'status_ru' => $s->status_ru,
+                'occurrences' => $s->occurrences,
+            ]);
+
+        return response()->json(['data' => $rows]);
+    }
+
+    /**
+     * POST /api/imports/unknown-statuses/resolve — ручной маппинг статусов.
+     *
+     * Defense-in-depth: явный where(tenant_id) поверх RLS.
+     */
+    public function resolveUnknownStatuses(ResolveUnknownStatusesRequest $request): JsonResponse
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+        $userId = (int) $request->user()->id;
+
+        DB::transaction(function () use ($request, $tenantId, $userId): void {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            foreach ($request->validated()['mappings'] as $mapping) {
+                ImportUnknownStatus::query()
+                    ->where('tenant_id', $tenantId)
+                    ->where('status_ru', $mapping['status_ru'])
+                    ->update([
+                        'mapped_to_slug' => $mapping['slug'],
+                        'resolved_at' => now(),
+                        'resolved_by' => $userId,
+                    ]);
+            }
+        });
+
+        return response()->json(['data' => ['resolved' => count($request->validated()['mappings'])]]);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function toResource(ImportLog $log): array
+    {
+        return [
+            'id' => $log->id,
+            'filename' => $log->filename,
+            'status' => $log->status,
+            'rows_total' => $log->rows_total,
+            'rows_added' => $log->rows_added,
+            'rows_updated' => $log->rows_updated,
+            'rows_skipped' => $log->rows_skipped,
+            'unknown_statuses_count' => $log->unknown_statuses_count,
+            'dry_run' => $log->dry_run,
+            'error_message' => $log->error_message,
+            'started_at' => $log->started_at?->toIso8601String(),
+            'finished_at' => $log->finished_at?->toIso8601String(),
+        ];
+    }
+}

app/app/Http/Controllers/Api/ReportJobController.php

@@ -13,7 +13,9 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\URL;
 use Illuminate\Validation\Rule;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * Reports API (schema §13.5). Все endpoint'ы под `auth:sanctum`.
@@ -340,6 +342,68 @@ class ReportJobController extends Controller
         });
     }
 
+    /**
+     * GET /api/reports/jobs/{id}/file?tenant=&expires=&signature= — скачать
+     * готовый файл отчёта (F2, OPEN-И-20).
+     *
+     * Под `signed`-middleware (не auth:sanctum): подпись URL = capability-token.
+     * `tenant` в подписи нужен для RLS-контекста (нет авторизованного user'а).
+     * Подпись покрывает все query-параметры — `tenant`/`id` подделать нельзя.
+     */
+    public function download(Request $request, int $id): Response
+    {
+        $tenantId = (int) $request->query('tenant', '0');
+
+        return DB::transaction(function () use ($id, $tenantId): Response {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            $job = ReportJob::query()
+                ->where('id', $id)
+                ->where('tenant_id', $tenantId)
+                ->first();
+
+            if ($job === null) {
+                return response()->json(['message' => 'Отчёт не найден.'], 404);
+            }
+
+            if ($job->status !== ReportJob::STATUS_DONE
+                || $job->file_path === null
+                || ($job->expires_at !== null && $job->expires_at->isPast())) {
+                return response()->json(['message' => 'Файл отчёта недоступен или истёк.'], 410);
+            }
+
+            if (! Storage::disk('local')->exists($job->file_path)) {
+                return response()->json(['message' => 'Файл отчёта не найден в хранилище.'], 404);
+            }
+
+            $extension = pathinfo($job->file_path, PATHINFO_EXTENSION);
+
+            return Storage::disk('local')->download(
+                $job->file_path,
+                sprintf('report-%d.%s', $job->id, $extension)
+            );
+        });
+    }
+
+    /**
+     * Signed URL (24 ч) на скачивание файла. NULL для не-готовых job'ов или
+     * после истечения retention (file_path обнулён cron'ом reports:cleanup-expired).
+     */
+    private function downloadUrl(ReportJob $job): ?string
+    {
+        if ($job->status !== ReportJob::STATUS_DONE
+            || $job->file_path === null
+            || ($job->expires_at !== null && $job->expires_at->isPast())) {
+            return null;
+        }
+
+        return URL::temporarySignedRoute(
+            'reports.download',
+            Carbon::now()->addHours(24),
+            ['id' => $job->id, 'tenant' => $job->tenant_id],
+        );
+    }
+
     /** @return array<string, mixed> */
     private function toResource(ReportJob $job): array
     {
@@ -358,6 +422,7 @@ class ReportJobController extends Controller
             'is_expired' => $job->expires_at !== null && $job->expires_at->isPast(),
             'retry_count' => (int) ($job->parameters['retry_count'] ?? 0),
             'retry_max' => self::RETRY_MAX_ATTEMPTS,
+            'download_url' => $this->downloadUrl($job),
         ];
     }
 }

app/app/Http/Controllers/Api/SupplierWebhookController.php

@@ -10,6 +10,7 @@ use App\Models\SupplierLead;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\RateLimiter;
 use Symfony\Component\HttpFoundation\IpUtils;
 
 /**
@@ -40,6 +41,9 @@ use Symfony\Component\HttpFoundation\IpUtils;
  */
 class SupplierWebhookController extends Controller
 {
+    /** Audit-fix C2: per-IP rate-limit (DoS-guard), запросов в минуту. */
+    private const RATE_LIMIT_PER_MINUTE = 600;
+
     public function receive(Request $request, string $secret): JsonResponse
     {
         if (! $this->verifySecret($secret)) {
@@ -50,6 +54,20 @@ class SupplierWebhookController extends Controller
             return response()->json(['message' => 'Not found.'], 404);
         }
 
+        // Audit-fix C2: per-IP rate-limit. Endpoint secret-gated, но защищаем
+        // от flood даже с валидным secret (DoS-guard). Лимит с запасом для
+        // легитимного stream'а лидов от crm.bp-gr.ru.
+        $rateKey = 'supplier-webhook:'.($request->ip() ?? 'unknown');
+        if (RateLimiter::tooManyAttempts($rateKey, self::RATE_LIMIT_PER_MINUTE)) {
+            $retryAfter = RateLimiter::availableIn($rateKey);
+
+            return response()->json([
+                'message' => 'Превышен лимит запросов.',
+                'retry_after' => $retryAfter,
+            ], 429)->header('Retry-After', (string) $retryAfter);
+        }
+        RateLimiter::hit($rateKey, 60);
+
         // Plan 2.6 fix #iii: timestamp partition guard. Партиции deals месячные
         // (deals_2026_MM); time за пределами текущего месяца → INSERT CRASH
         // "no partition of relation deals found for row" в RouteSupplierLeadJob.

app/app/Http/Controllers/Api/WebhookReceiveController.php

@@ -117,17 +117,19 @@ class WebhookReceiveController extends Controller
     }
 
     /**
-     * HMAC-обязательность. Если ключ отсутствует в БД — default false
-     * (backward-compat для существующих интеграций).
+     * HMAC-обязательность. Audit-fix B3: если ключ отсутствует в БД — default
+     * TRUE (HMAC обязателен по умолчанию). Отключить можно только явной
+     * установкой webhook_hmac_required=false. Неизвестное значение → fail-secure
+     * (HMAC требуется).
      */
     private function isHmacRequired(): bool
     {
         $setting = SystemSetting::find('webhook_hmac_required');
         if ($setting === null) {
-            return false;
+            return true;
         }
 
-        return in_array($setting->value, ['true', '1'], true);
+        return ! in_array($setting->value, ['false', '0'], true);
     }
 
     /**

app/app/Http/Controllers/Api/WebhookSettingsController.php

@@ -0,0 +1,137 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\OutboundWebhookSubscription;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Настройки исходящего webhook'а тенанта (audit D4/D5/J5).
+ * Endpoints под auth:sanctum + tenant.
+ *
+ * Одна подписка-ряд на тенанта. Секрет генерируется при создании и
+ * показывается ОДИН раз (в БД — bcrypt secret_hash + secret_prefix).
+ *
+ * test(): MVP делает unsigned connectivity-проверку (реальный POST на
+ * target_url, отчёт по HTTP-статусу). HMAC-подписанная доставка событий —
+ * отдельный пост-MVP эпик (outbound-pipeline пока не построен).
+ */
+class WebhookSettingsController extends Controller
+{
+    private const SECRET_PREFIX = 'whsec_';
+
+    /** @var list<string> События по умолчанию для новой подписки. */
+    private const DEFAULT_EVENTS = ['deal.created', 'deal.status_changed'];
+
+    public function show(Request $request): JsonResponse
+    {
+        $sub = $this->currentSubscription($request);
+
+        if ($sub === null) {
+            return response()->json(['data' => null]);
+        }
+
+        return response()->json(['data' => [
+            'target_url' => $sub->target_url,
+            'secret_prefix' => $sub->secret_prefix,
+            'events' => $sub->events,
+            'is_active' => $sub->is_active,
+        ]]);
+    }
+
+    public function update(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'target_url' => ['required', 'string', 'url', 'max:2048', 'starts_with:https://'],
+        ]);
+
+        $sub = $this->currentSubscription($request);
+        $plainSecret = null;
+
+        if ($sub === null) {
+            $plainSecret = self::SECRET_PREFIX.Str::random(40);
+            $sub = OutboundWebhookSubscription::query()->create([
+                'tenant_id' => (int) $request->user()->tenant_id,
+                'user_id' => (int) $request->user()->id,
+                'name' => 'Webhook',
+                'target_url' => $validated['target_url'],
+                'secret_hash' => Hash::make($plainSecret),
+                'secret_prefix' => substr($plainSecret, 0, 10),
+                'events' => self::DEFAULT_EVENTS,
+                'is_active' => true,
+            ]);
+        } else {
+            $sub->update(['target_url' => $validated['target_url']]);
+        }
+
+        $payload = [
+            'target_url' => $sub->target_url,
+            'secret_prefix' => $sub->secret_prefix,
+            'events' => $sub->events,
+            'is_active' => $sub->is_active,
+        ];
+        if ($plainSecret !== null) {
+            $payload['secret'] = $plainSecret;
+        }
+
+        return response()->json(['data' => $payload]);
+    }
+
+    public function test(Request $request): JsonResponse
+    {
+        $sub = $this->currentSubscription($request);
+
+        if ($sub === null) {
+            return response()->json([
+                'message' => 'Сначала сохраните URL webhook.',
+            ], Response::HTTP_UNPROCESSABLE_ENTITY);
+        }
+
+        $testPayload = [
+            'event' => 'webhook.test',
+            'sent_at' => now()->toIso8601String(),
+            'message' => 'Тестовая доставка webhook от Лидерра.',
+        ];
+
+        // MVP: unsigned connectivity-проверка. SSRF-харднинг (блок приватных
+        // IP) — пост-MVP security-review; URL уже ограничен https:// валидацией.
+        try {
+            $response = Http::timeout(10)
+                ->withHeaders(['X-Webhook-Event' => 'webhook.test'])
+                ->post($sub->target_url, $testPayload);
+
+            return response()->json([
+                'ok' => $response->successful(),
+                'status' => $response->status(),
+                'message' => $response->successful()
+                    ? "Тестовый запрос доставлен (HTTP {$response->status()})."
+                    : "Endpoint ответил HTTP {$response->status()}.",
+            ]);
+        } catch (\Throwable $e) {
+            return response()->json([
+                'ok' => false,
+                'status' => null,
+                'message' => 'Не удалось доставить тестовый запрос: '.$e->getMessage(),
+            ]);
+        }
+    }
+
+    private function currentSubscription(Request $request): ?OutboundWebhookSubscription
+    {
+        $tenantId = (int) $request->user()->tenant_id;
+
+        // Defense-in-depth: явный where даже при RLS — в тестах PG superuser BYPASSRLS.
+        return OutboundWebhookSubscription::query()
+            ->where('tenant_id', $tenantId)
+            ->orderByDesc('id')
+            ->first();
+    }
+}

app/app/Http/Controllers/Concerns/ResolvesAdminUserId.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Concerns;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Резолв saas_admin_users.id для audit-trail на MVP (saas-admin SSO ⏸ Б-1).
+ *
+ * Берёт admin_user_id из request-параметра; при отсутствии валидного —
+ * создаёт/переиспользует системный стаб-аккаунт (не loginable, is_active=false),
+ * чтобы соблюсти NOT NULL + FK на saas_admin_users в saas_admin_audit_log.
+ *
+ * Паттерн ранее дублировался в AdminPricingTiersController /
+ * AdminSystemSettingsController; новый код использует этот трейт.
+ */
+trait ResolvesAdminUserId
+{
+    protected function resolveAdminUserId(Request $request, string $stubEmail, string $stubName): int
+    {
+        $requested = $request->input('admin_user_id');
+        if (is_int($requested) || (is_string($requested) && ctype_digit($requested))) {
+            $existing = DB::table('saas_admin_users')->where('id', (int) $requested)->value('id');
+            if ($existing !== null) {
+                return (int) $existing;
+            }
+        }
+
+        $existingId = DB::table('saas_admin_users')->where('email', $stubEmail)->value('id');
+        if ($existingId !== null) {
+            return (int) $existingId;
+        }
+
+        return (int) DB::table('saas_admin_users')->insertGetId([
+            'email' => $stubEmail,
+            'full_name' => $stubName,
+            'password_hash' => '$2y$04$system-stub-not-loginable',
+            'role' => 'super_admin',
+            'is_active' => false,
+            'sso_provider' => 'local',
+            'is_break_glass' => false,
+        ]);
+    }
+}

app/app/Http/Middleware/EnsureSaasAdmin.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Гейт SaaS-admin зоны (/api/admin/*) — audit-находка J2.
+ *
+ * СТАБ (Sprint 3F): полноценная авторизация saas-admin требует Yandex 360
+ * SSO-входа, который гейтится Б-1 (регистрация ООО) + DO-4. До их закрытия
+ * реального механизма аутентификации нет.
+ *
+ * Поведение стаба:
+ *   - dev / testing (local, testing) → пропускаем. Admin-панель работает на
+ *     dev; admin_user_id передаётся параметром (трейт ResolvesAdminUserId).
+ *   - прочие окружения (production / staging) → fail-closed 503: зона
+ *     закрыта до подключения реального SSO. Явный 503 лучше, чем тихо
+ *     открытый /api/admin/* в проде.
+ *
+ * TODO (после Б-1 + DO-4): заменить на проверку Yandex 360 SSO-сессии
+ * saas-admin (отдельный guard) + роль (compliance и т.п. где требуется).
+ */
+class EnsureSaasAdmin
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! app()->environment('local', 'testing')) {
+            abort(503, 'SaaS-admin авторизация не настроена (ожидает Б-1 + DO-4).');
+        }
+
+        return $next($request);
+    }
+}

app/app/Http/Middleware/SetTenantContext.php

@@ -66,7 +66,10 @@ class SetTenantContext
             }
         }
 
-        if ($request->hasHeader('X-Tenant-Id')) {
+        // Audit-fix A3: X-Tenant-Id принимается ТОЛЬКО на dev/testing. На prod
+        // заголовок игнорируется — иначе на любом роуте с `tenant`, но без
+        // auth-middleware возможен спуфинг тенанта произвольным значением.
+        if (app()->environment('local', 'testing') && $request->hasHeader('X-Tenant-Id')) {
             $headerValue = $request->header('X-Tenant-Id');
             if (is_string($headerValue) && ctype_digit($headerValue)) {
                 return (int) $headerValue;

app/app/Http/Requests/ResolveUnknownStatusesRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * Валидация ручного маппинга неизвестных статусов воронки (§6.4 wizard).
+ */
+class ResolveUnknownStatusesRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'mappings' => ['required', 'array', 'min:1'],
+            'mappings.*.status_ru' => ['required', 'string', 'max:100'],
+            'mappings.*.slug' => ['required', 'string', Rule::exists('lead_statuses', 'slug')],
+        ];
+    }
+}

app/app/Http/Requests/StoreImportRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * Валидация загрузки CSV-файла импорта (ТЗ §6.2).
+ */
+class StoreImportRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            // mimes csv,txt — экспорт crm.bp-gr.ru отдаётся как text/csv или text/plain.
+            'file' => ['required', 'file', 'mimes:csv,txt', 'max:10240'],
+            'dry_run' => ['sometimes', 'boolean'],
+        ];
+    }
+}

app/app/Jobs/ImportLeadsJob.php

@@ -0,0 +1,147 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Jobs;
+
+use App\Mail\ImportCompletedNotification;
+use App\Models\ImportLog;
+use App\Models\User;
+use App\Services\Import\CsvLeadsParser;
+use App\Services\Import\HistoricalImportService;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Storage;
+use RuntimeException;
+use Throwable;
+
+/**
+ * Асинхронная обработка CSV-импорта исторических лидов (ТЗ §6.6).
+ *
+ * Жизненный цикл import_log: pending → processing → done | failed.
+ * RLS: каждый доступ к БД задаёт SET LOCAL app.current_tenant_id (воркер
+ * вне middleware-контекста — паритет с ProcessWebhookJob).
+ */
+class ImportLeadsJob implements ShouldQueue
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+    use SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 600;
+
+    public function __construct(
+        public int $importLogId,
+        public int $tenantId,
+    ) {}
+
+    public function handle(HistoricalImportService $service, CsvLeadsParser $parser): void
+    {
+        $log = $this->loadLog();
+        if ($log === null) {
+            Log::error('import.log_not_found', ['import_log_id' => $this->importLogId]);
+
+            return;
+        }
+
+        $this->updateLog($log->id, ['status' => 'processing', 'started_at' => now()]);
+
+        try {
+            if (! Storage::disk('local')->exists($log->file_path)) {
+                throw new RuntimeException("Файл импорта не найден: {$log->file_path}");
+            }
+
+            $content = (string) Storage::disk('local')->get($log->file_path);
+            $parsed = $parser->parse($content);
+
+            $result = $service->import($this->tenantId, $log->user_id, $log, $parsed->rows);
+
+            $this->updateLog($log->id, [
+                'status' => 'done',
+                'rows_total' => count($parsed->rows) + count($parsed->errors),
+                'rows_added' => $result->added,
+                'rows_updated' => $result->updated,
+                'rows_skipped' => count($parsed->errors) + $result->skipped,
+                'unknown_statuses_count' => count($result->unknownStatuses),
+                'finished_at' => now(),
+            ]);
+
+            $this->notify($log->user_id, 'done');
+        } catch (Throwable $e) {
+            Log::error('import.job_failed', ['import_log_id' => $log->id, 'error' => $e->getMessage()]);
+            $this->updateLog($log->id, [
+                'status' => 'failed',
+                'error_message' => $e->getMessage(),
+                'finished_at' => now(),
+            ]);
+            $this->notify($log->user_id, 'failed');
+        }
+    }
+
+    private function loadLog(): ?ImportLog
+    {
+        return DB::transaction(function (): ?ImportLog {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$this->tenantId);
+
+            return ImportLog::query()->find($this->importLogId);
+        });
+    }
+
+    /**
+     * @param  array<string, mixed>  $attributes
+     */
+    private function updateLog(int $logId, array $attributes): void
+    {
+        DB::transaction(function () use ($logId, $attributes): void {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$this->tenantId);
+            ImportLog::query()->whereKey($logId)->update($attributes);
+        });
+    }
+
+    private function notify(int $userId, string $outcome): void
+    {
+        $log = $this->loadLog();
+        $user = DB::transaction(function () use ($userId): ?User {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$this->tenantId);
+
+            return User::query()->find($userId);
+        });
+
+        if ($log === null || $user === null || $user->email === '') {
+            return;
+        }
+
+        try {
+            Mail::to($user->email)->send(new ImportCompletedNotification($log, $outcome));
+        } catch (Throwable $e) {
+            // Отказ почтового канала не должен валить успешный импорт.
+            Log::warning('import.mail_failed', ['import_log_id' => $log->id, 'error' => $e->getMessage()]);
+        }
+    }
+
+    /**
+     * Финальный callback после исчерпания ретраев ($tries=1).
+     */
+    public function failed(Throwable $e): void
+    {
+        $this->updateLog($this->importLogId, [
+            'status' => 'failed',
+            'error_message' => $e->getMessage(),
+            'finished_at' => now(),
+        ]);
+
+        Log::error('import.job_failed_permanently', [
+            'import_log_id' => $this->importLogId,
+            'exception' => $e->getMessage(),
+        ]);
+    }
+}

app/app/Mail/ImportCompletedNotification.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\ImportLog;
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * Уведомление о завершении CSV-импорта исторических лидов (ТЗ §6.6).
+ */
+class ImportCompletedNotification extends Mailable
+{
+    use Queueable;
+    use SerializesModels;
+
+    /**
+     * @param  string  $outcome  'done' | 'failed'
+     */
+    public function __construct(
+        public ImportLog $log,
+        public string $outcome,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        $subject = $this->outcome === 'done'
+            ? 'Импорт данных завершён — Лидерра'
+            : 'Импорт данных не удался — Лидерра';
+
+        return new Envelope(subject: $subject);
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            markdown: 'mail.import-completed',
+            with: [
+                'log' => $this->log,
+                'outcome' => $this->outcome,
+            ],
+        );
+    }
+}

app/app/Models/ApiKey.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Database\Factories\ApiKeyFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * API-ключ тенанта (таблица api_keys). Tenant-aware, RLS на уровне БД.
+ *
+ * key_hash — bcrypt-хэш; оригинал ключа показывается ОДИН раз при генерации
+ * (ApiKeyController::regenerate). key_prefix (10 символов) — для отображения
+ * в UI. Таблица имеет только created_at (без updated_at).
+ *
+ * @mixin IdeHelperApiKey
+ */
+class ApiKey extends Model
+{
+    /** @use HasFactory<ApiKeyFactory> */
+    use HasFactory;
+
+    public $timestamps = false;
+
+    protected $fillable = [
+        'tenant_id',
+        'user_id',
+        'name',
+        'key_hash',
+        'key_prefix',
+        'scopes',
+        'last_used_at',
+        'last_used_ip',
+        'expires_at',
+        'is_active',
+        'created_at',
+    ];
+
+    protected $hidden = ['key_hash'];
+
+    protected function casts(): array
+    {
+        return [
+            'scopes' => 'array',
+            'is_active' => 'boolean',
+            'last_used_at' => 'datetime',
+            'expires_at' => 'datetime',
+            'created_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<Tenant, $this> */
+    public function tenant(): BelongsTo
+    {
+        return $this->belongsTo(Tenant::class);
+    }
+
+    /** @return BelongsTo<User, $this> */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/app/Models/BalanceTransaction.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Models;
 
+use Database\Factories\BalanceTransactionFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
@@ -19,6 +21,9 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
  */
 class BalanceTransaction extends Model
 {
+    /** @use HasFactory<BalanceTransactionFactory> */
+    use HasFactory;
+
     public const TYPE_TRIAL_BONUS = 'trial_bonus';
 
     public const TYPE_TOPUP = 'topup';

app/app/Models/ImportLog.php

@@ -0,0 +1,92 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Database\Factories\ImportLogFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Журнал CSV-импорта (schema §6.7, Sprint 4).
+ *
+ * Tenant-aware модель с RLS: tenant_isolation по current_setting('app.current_tenant_id').
+ * Sprint 4 enrichment: entity_type / source_system / mapping_config / unknown_statuses_count / dry_run.
+ *
+ * @mixin IdeHelperImportLog
+ */
+class ImportLog extends Model
+{
+    /** @use HasFactory<ImportLogFactory> */
+    use HasFactory;
+
+    public const UPDATED_AT = null;
+
+    public const CREATED_AT = null;
+
+    protected $table = 'import_log';
+
+    /** Зеркало DB DEFAULT'ов: Laravel не читает их из БД после INSERT без refresh(). */
+    protected $attributes = [
+        'status' => 'pending',
+        'entity_type' => 'leads',
+        'source_system' => 'crm.bp-gr.ru',
+        'dry_run' => false,
+        'unknown_statuses_count' => 0,
+        'rows_total' => 0,
+        'rows_added' => 0,
+        'rows_updated' => 0,
+        'rows_skipped' => 0,
+    ];
+
+    protected $fillable = [
+        'tenant_id',
+        'user_id',
+        'filename',
+        'file_path',
+        'rows_total',
+        'rows_added',
+        'rows_updated',
+        'rows_skipped',
+        'status',
+        'error_message',
+        'started_at',
+        'finished_at',
+        'entity_type',
+        'source_system',
+        'mapping_config',
+        'unknown_statuses_count',
+        'dry_run',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'tenant_id' => 'integer',
+            'user_id' => 'integer',
+            'rows_total' => 'integer',
+            'rows_added' => 'integer',
+            'rows_updated' => 'integer',
+            'rows_skipped' => 'integer',
+            'unknown_statuses_count' => 'integer',
+            'dry_run' => 'boolean',
+            'mapping_config' => 'array',
+            'started_at' => 'datetime',
+            'finished_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<Tenant, $this> */
+    public function tenant(): BelongsTo
+    {
+        return $this->belongsTo(Tenant::class);
+    }
+
+    /** @return BelongsTo<User, $this> */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/app/Models/ImportUnknownStatus.php

@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Database\Factories\ImportUnknownStatusFactory;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Неизвестный статус воронки из CSV-импорта (schema §6.4, Sprint 4 H1).
+ *
+ * Tenant-aware модель с RLS. UNIQUE (tenant_id, status_ru): повторный импорт
+ * инкрементит occurrences и переиспользует ранее проставленный mapped_to_slug.
+ *
+ * @mixin IdeHelperImportUnknownStatus
+ */
+class ImportUnknownStatus extends Model
+{
+    /** @use HasFactory<ImportUnknownStatusFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'tenant_id',
+        'import_log_id',
+        'status_ru',
+        'occurrences',
+        'mapped_to_slug',
+        'resolved_at',
+        'resolved_by',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'tenant_id' => 'integer',
+            'import_log_id' => 'integer',
+            'occurrences' => 'integer',
+            'resolved_by' => 'integer',
+            'resolved_at' => 'datetime',
+            'created_at' => 'datetime',
+            'updated_at' => 'datetime',
+        ];
+    }
+
+    /**
+     * Незамапленные статусы (mapped_to_slug IS NULL) — вход для wizard'а §6.6.
+     *
+     * @param  Builder<ImportUnknownStatus>  $query
+     * @return Builder<ImportUnknownStatus>
+     */
+    public function scopeUnresolved(Builder $query): Builder
+    {
+        return $query->whereNull('mapped_to_slug');
+    }
+
+    /** @return BelongsTo<Tenant, $this> */
+    public function tenant(): BelongsTo
+    {
+        return $this->belongsTo(Tenant::class);
+    }
+}

app/app/Models/OutboundWebhookSubscription.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Database\Factories\OutboundWebhookSubscriptionFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * Исходящая webhook-подписка тенанта (таблица outbound_webhook_subscriptions).
+ *
+ * Tenant-aware, RLS на уровне БД.
+ *
+ * secret_hash — bcrypt-хэш; оригинал секрета показывается ОДИН раз при
+ * создании. events — JSONB-массив, CHECK требует ≥1 элемента.
+ *
+ * NB: outbound-доставка событий (подписанные webhook'и) — пост-MVP; пока
+ * подписка хранит URL + секрет, а WebhookSettingsController::test делает
+ * unsigned connectivity-проверку.
+ *
+ * @mixin IdeHelperOutboundWebhookSubscription
+ */
+class OutboundWebhookSubscription extends Model
+{
+    /** @use HasFactory<OutboundWebhookSubscriptionFactory> */
+    use HasFactory;
+
+    protected $fillable = [
+        'tenant_id',
+        'user_id',
+        'name',
+        'target_url',
+        'secret_hash',
+        'secret_prefix',
+        'events',
+        'custom_headers',
+        'is_active',
+        'paused_at',
+    ];
+
+    protected $hidden = ['secret_hash'];
+
+    protected function casts(): array
+    {
+        return [
+            'events' => 'array',
+            'custom_headers' => 'array',
+            'is_active' => 'boolean',
+            'consecutive_failures' => 'integer',
+            'paused_at' => 'datetime',
+            'last_delivery_at' => 'datetime',
+            'last_failure_at' => 'datetime',
+            'created_at' => 'datetime',
+            'updated_at' => 'datetime',
+        ];
+    }
+
+    /** @return BelongsTo<Tenant, $this> */
+    public function tenant(): BelongsTo
+    {
+        return $this->belongsTo(Tenant::class);
+    }
+
+    /** @return BelongsTo<User, $this> */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/app/Models/TariffPlan.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+/**
+ * Тарифный план SaaS-портала (каталог tariff_plans).
+ *
+ * Сидится из db/schema.sql (4 стартовых плана: start/basic/pro/enterprise).
+ * Read-mostly: редактируется только админкой SaaS. Tenant ссылается через
+ * tenants.current_tariff_id (см. Tenant::tariff()).
+ *
+ * Источник: db/schema.sql §20.2.1, table `tariff_plans`.
+ *
+ * @mixin IdeHelperTariffPlan
+ */
+class TariffPlan extends Model
+{
+    protected $fillable = [
+        'code',
+        'name',
+        'description',
+        'billing_model',
+        'price_per_lead',
+        'price_monthly',
+        'included_leads',
+        'limits',
+        'features',
+        'trial_bonus_leads',
+        'is_active',
+        'is_public',
+        'sort_order',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'price_per_lead' => 'decimal:2',
+            'price_monthly' => 'decimal:2',
+            'included_leads' => 'integer',
+            'limits' => 'array',
+            'features' => 'array',
+            'trial_bonus_leads' => 'integer',
+            'is_active' => 'boolean',
+            'is_public' => 'boolean',
+            'sort_order' => 'integer',
+            'created_at' => 'datetime',
+            'updated_at' => 'datetime',
+        ];
+    }
+}

app/app/Models/Tenant.php

@@ -7,6 +7,7 @@ namespace App\Models;
 use Database\Factories\TenantFactory;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
@@ -80,4 +81,10 @@ class Tenant extends Model
     {
         return $this->hasMany(Project::class);
     }
+
+    /** @return BelongsTo<TariffPlan, $this> */
+    public function tariff(): BelongsTo
+    {
+        return $this->belongsTo(TariffPlan::class, 'current_tariff_id');
+    }
 }

app/app/Services/Billing/BillingTopupService.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Billing;
+
+use App\Models\BalanceTransaction;
+use App\Models\Tenant;
+
+/**
+ * Сервис пополнения рублёвого баланса тенанта (audit E1).
+ *
+ * MVP-stub: кредитует tenants.balance_rub немедленно и пишет строку
+ * balance_transactions(type='topup'). Реальная оплата через платёжный
+ * шлюз — post-Б-1 (требует реквизитов ООО), здесь НЕ интегрирована.
+ *
+ * Контракт: вызывается ВНУТРИ транзакции (middleware `tenant` оборачивает
+ * HTTP-запрос в DB-транзакцию). lockForUpdate на строке tenant защищает от
+ * lost-update при конкурентных topup/charge.
+ *
+ * balance_transactions защищена hash-chain триггером (BEFORE INSERT
+ * audit_chain_hash) — log_hash заполняется автоматически. UPDATE/DELETE
+ * на таблице запрещены триггером audit_block_mutation, поэтому каждое
+ * пополнение — отдельная append-only строка; существующие не меняются.
+ */
+final class BillingTopupService
+{
+    /**
+     * Пополнить рублёвый баланс тенанта.
+     *
+     * @param  int  $tenantId  ID тенанта.
+     * @param  string  $amountRub  Сумма пополнения, DECIMAL-строка («100.00»).
+     * @param  int|null  $userId  Кто инициировал (NULL — системное).
+     * @return BalanceTransaction Созданная append-only строка ledger'а.
+     */
+    public function topup(int $tenantId, string $amountRub, ?int $userId): BalanceTransaction
+    {
+        /** @var Tenant $tenant */
+        $tenant = Tenant::query()->lockForUpdate()->findOrFail($tenantId);
+
+        // bcadd — DECIMAL-точность, НЕ PHP float (паттерн LedgerService).
+        $newBalanceRub = bcadd((string) $tenant->balance_rub, $amountRub, 2);
+
+        // Eloquent decimal:2 cast сохраняет bcmath-строку без потери точности
+        // при save() (в отличие от decrement(), который требует float|int —
+        // именно поэтому LedgerService использует raw DB::table()->update();
+        // здесь же присваивание уже посчитанной строки через модель безопасно).
+        $tenant->balance_rub = $newBalanceRub;
+        $tenant->save();
+
+        return BalanceTransaction::create([
+            'tenant_id' => $tenant->id,
+            'type' => BalanceTransaction::TYPE_TOPUP,
+            'amount_rub' => $amountRub,
+            'amount_leads' => 0,
+            'balance_rub_after' => $newBalanceRub,
+            'balance_leads_after' => (int) $tenant->balance_leads,
+            'description' => 'Пополнение баланса',
+            'user_id' => $userId,
+            'created_at' => now(),
+        ]);
+    }
+}

app/app/Services/Import/CsvLeadsParser.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+use Carbon\CarbonImmutable;
+use Throwable;
+
+/**
+ * Парсер CSV-выгрузки лидов из crm.bp-gr.ru (ТЗ §6.2/§6.3).
+ *
+ * Формат: UTF-8 с BOM, разделитель — запятая, дата `Y/m/d H:i:s`,
+ * телефон `7XXXXXXXXXX`. Заголовок:
+ *   id,Проект,Тег проекта,Телефон,Создано,Напоминание,Комментарий,Состояние,Имя
+ *
+ * Невалидные строки не роняют парсинг — собираются в errors[].
+ * Файл целиком загружается в память (MVP: ожидаемый объём — единицы тысяч строк).
+ */
+final class CsvLeadsParser
+{
+    private const EXPECTED_COLUMNS = 9;
+
+    private const DATE_FORMAT = 'Y/m/d H:i:s';
+
+    public function parse(string $content): CsvParseResult
+    {
+        // Срезаем UTF-8 BOM.
+        if (str_starts_with($content, "\xEF\xBB\xBF")) {
+            $content = substr($content, 3);
+        }
+
+        $lines = preg_split('/\r\n|\r|\n/', trim($content)) ?: [];
+        $rows = [];
+        $errors = [];
+
+        // Строка 1 — заголовок, пропускаем. dataLine — абсолютный номер строки файла (заголовок = 1).
+        foreach (array_slice($lines, 1) as $index => $rawLine) {
+            $dataLine = $index + 2; // +2: пропущен заголовок (index 0 → строка 2)
+
+            if (trim($rawLine) === '') {
+                continue;
+            }
+
+            $cells = str_getcsv($rawLine);
+
+            if (count($cells) < self::EXPECTED_COLUMNS) {
+                $errors[] = ['line' => $dataLine, 'message' => 'Ожидалось '.self::EXPECTED_COLUMNS.' колонок, получено '.count($cells)];
+
+                continue;
+            }
+
+            $parsed = $this->parseRow($cells, $dataLine, $errors);
+            if ($parsed !== null) {
+                $rows[] = $parsed;
+            }
+        }
+
+        return new CsvParseResult($rows, $errors);
+    }
+
+    /**
+     * @param  array<int, string>  $cells
+     * @param  array<int, array{line: int, message: string}>  $errors
+     */
+    private function parseRow(array $cells, int $dataLine, array &$errors): ?ParsedLeadRow
+    {
+        [$id, $project, $tag, $phone, $createdAt, $reminder, $comment, $status, $name] = $cells;
+
+        $phone = trim($phone);
+        if (preg_match('/^7\d{10}$/', $phone) !== 1) {
+            $errors[] = ['line' => $dataLine, 'message' => "Невалидный телефон: '{$phone}'"];
+
+            return null;
+        }
+
+        $receivedAt = $this->parseDate($createdAt);
+        if ($receivedAt === null) {
+            $errors[] = ['line' => $dataLine, 'message' => "Невалидная дата 'Создано': '{$createdAt}'"];
+
+            return null;
+        }
+
+        $reminderAt = trim($reminder) === '' ? null : $this->parseDate($reminder);
+        if (trim($reminder) !== '' && $reminderAt === null) {
+            $errors[] = ['line' => $dataLine, 'message' => "Невалидная дата 'Напоминание': '{$reminder}'"];
+
+            return null;
+        }
+
+        $status = trim($status);
+        if ($status === '') {
+            $errors[] = ['line' => $dataLine, 'message' => 'Пустое поле «Состояние»'];
+
+            return null;
+        }
+
+        // Префикс B[123]_ из названия проекта срезается (паритет с ProcessWebhookJob).
+        $projectName = (string) preg_replace('/^B[123]_/', '', trim($project));
+        if ($projectName === '') {
+            $errors[] = ['line' => $dataLine, 'message' => 'Пустое название проекта'];
+
+            return null;
+        }
+
+        return new ParsedLeadRow(
+            sourceCrmId: (int) trim($id),
+            projectName: $projectName,
+            projectTag: trim($tag) === '' ? null : trim($tag),
+            phone: $phone,
+            receivedAt: $receivedAt,
+            reminderAt: $reminderAt,
+            comment: trim($comment) === '' ? null : trim($comment),
+            statusRu: $status,
+            contactName: trim($name) === '' ? null : trim($name),
+        );
+    }
+
+    private function parseDate(string $value): ?CarbonImmutable
+    {
+        try {
+            $date = CarbonImmutable::createFromFormat(self::DATE_FORMAT, trim($value));
+        } catch (Throwable) {
+            return null;
+        }
+
+        // createFromFormat возвращает false при несовпадении формата.
+        return $date instanceof CarbonImmutable ? $date : null;
+    }
+}

app/app/Services/Import/CsvParseResult.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+/**
+ * Результат парсинга CSV: валидные строки + ошибки по номеру строки.
+ */
+final readonly class CsvParseResult
+{
+    /**
+     * @param  array<int, ParsedLeadRow>  $rows
+     * @param  array<int, array{line: int, message: string}>  $errors
+     */
+    public function __construct(
+        public array $rows,
+        public array $errors,
+    ) {}
+}

app/app/Services/Import/HistoricalImportService.php

@@ -0,0 +1,285 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+use App\Models\Deal;
+use App\Models\ImportLog;
+use App\Models\ImportUnknownStatus;
+use App\Models\Project;
+use App\Models\Reminder;
+use App\Services\MonthlyPartitionManager;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+/**
+ * Оркестрация исторической миграции лидов из CSV crm.bp-gr.ru (ТЗ §6).
+ *
+ * Идемпотентность — через webhook_dedup_keys (та же advisory-lock логика, что
+ * ProcessWebhookJob). Баланс НЕ списывается: исторические данные не являются
+ * новыми лидами (ТЗ §6.5) — фиксируется одна транзакция типа historical_import.
+ */
+final class HistoricalImportService
+{
+    public function __construct(
+        private readonly MonthlyPartitionManager $partitions,
+        private readonly StatusRuToSlugMapper $statusMapper,
+    ) {}
+
+    /**
+     * @param  array<int, ParsedLeadRow>  $rows
+     */
+    public function import(int $tenantId, int $userId, ImportLog $log, array $rows): ImportResult
+    {
+        $dryRun = $log->dry_run;
+
+        if ($rows === []) {
+            return new ImportResult(0, 0, 0, [], []);
+        }
+
+        // Партиции deals под исторический диапазон дат CSV (один раз заранее).
+        if (! $dryRun) {
+            $dates = array_map(fn (ParsedLeadRow $r) => $r->receivedAt, $rows);
+            $this->partitions->ensureRange(
+                'deals',
+                min($dates),
+                max($dates),
+            );
+        }
+
+        // Tenant-резолвленные переопределения неизвестных статусов.
+        $overrides = $this->loadStatusOverrides($tenantId);
+
+        $added = 0;
+        $updated = 0;
+        $skipped = 0;
+        $unknown = [];
+        $errors = [];
+
+        foreach ($rows as $row) {
+            $slug = $this->resolveStatus($row->statusRu, $overrides, $unknown);
+
+            if ($dryRun) {
+                $added++; // проекция: для dry-run не различаем add/update
+
+                continue;
+            }
+
+            try {
+                $wasCreated = $this->upsertRow($tenantId, $userId, $row, $slug);
+                $wasCreated ? $added++ : $updated++;
+            } catch (Throwable $e) {
+                $skipped++;
+                $errors[] = ['source_crm_id' => $row->sourceCrmId, 'message' => $e->getMessage()];
+                Log::warning('import.row_failed', ['source_crm_id' => $row->sourceCrmId, 'error' => $e->getMessage()]);
+            }
+        }
+
+        if (! $dryRun) {
+            $this->persistUnknownStatuses($tenantId, $log->id, $unknown);
+            $this->recordHistoricalTransaction($tenantId, $added + $updated);
+        }
+
+        return new ImportResult($added, $updated, $skipped, $unknown, $errors);
+    }
+
+    /**
+     * @return array<string, string> status_ru => slug (только resolved)
+     */
+    private function loadStatusOverrides(int $tenantId): array
+    {
+        return DB::transaction(function () use ($tenantId): array {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            // Явный where(tenant_id) — defense-in-depth: queue worker на prod
+            // (crm_supplier_worker) — BYPASSRLS, SET LOCAL не фильтрует
+            // (00_create_roles.sql §5). Без фильтра — cross-tenant утечка маппинга.
+            return ImportUnknownStatus::query()
+                ->where('tenant_id', $tenantId)
+                ->whereNotNull('mapped_to_slug')
+                ->pluck('mapped_to_slug', 'status_ru')
+                ->all();
+        });
+    }
+
+    /**
+     * Маппит статус: каноническая таблица §6.4 → tenant-override → fallback 'new'.
+     * Неизвестный статус инкрементит счётчик в $unknown по ссылке.
+     *
+     * @param  array<string, string>  $overrides
+     * @param  array<string, int>  $unknown
+     */
+    private function resolveStatus(string $statusRu, array $overrides, array &$unknown): string
+    {
+        $slug = $this->statusMapper->toSlug($statusRu);
+        if ($slug !== null) {
+            return $slug;
+        }
+
+        $key = trim($statusRu);
+        if (isset($overrides[$key])) {
+            return $overrides[$key];
+        }
+
+        $unknown[$key] = ($unknown[$key] ?? 0) + 1;
+
+        return 'new';
+    }
+
+    /**
+     * Идемпотентный upsert одной строки в собственной транзакции.
+     * Возвращает true — создана новая сделка, false — обновлена существующая.
+     */
+    private function upsertRow(int $tenantId, int $userId, ParsedLeadRow $row, string $slug): bool
+    {
+        return DB::transaction(function () use ($tenantId, $userId, $row, $slug): bool {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            $project = Project::firstOrCreate(
+                ['tenant_id' => $tenantId, 'name' => $row->projectName],
+                ['tag' => $row->projectTag, 'type' => 'import'],
+            );
+
+            // advisory lock (tenant_id, source_crm_id) — сериализует upsert (§6.5).
+            $lockKey = (($tenantId & 0xFFFFFFFF) << 32) | ($row->sourceCrmId & 0xFFFFFFFF);
+            DB::statement('SELECT pg_advisory_xact_lock(?)', [$lockKey]);
+
+            $existing = DB::selectOne(
+                'SELECT deal_id, deal_received_at FROM webhook_dedup_keys WHERE tenant_id = ? AND source_crm_id = ?',
+                [$tenantId, $row->sourceCrmId],
+            );
+
+            if ($existing !== null) {
+                $deal = Deal::query()
+                    ->where('id', $existing->deal_id)
+                    ->where('received_at', $existing->deal_received_at)
+                    ->firstOrFail();
+                // §6.5 стадия 3a: для исторической миграции status перезаписывается.
+                $deal->update([
+                    'status' => $slug,
+                    'contact_name' => $row->contactName,
+                    'comment' => $row->comment,
+                ]);
+                $this->syncReminder($tenantId, $userId, $deal, $row);
+
+                return false;
+            }
+
+            $deal = Deal::create([
+                'tenant_id' => $tenantId,
+                'source_crm_id' => $row->sourceCrmId,
+                'project_id' => $project->id,
+                'phone' => $row->phone,
+                'status' => $slug,
+                'contact_name' => $row->contactName,
+                'comment' => $row->comment,
+                'received_at' => $row->receivedAt,
+            ]);
+
+            DB::table('webhook_dedup_keys')->insert([
+                'tenant_id' => $tenantId,
+                'source_crm_id' => $row->sourceCrmId,
+                'deal_id' => $deal->id,
+                'deal_received_at' => $deal->received_at,
+                'created_at' => now(),
+            ]);
+
+            $this->syncReminder($tenantId, $userId, $deal, $row);
+
+            return true;
+        });
+    }
+
+    /**
+     * Создаёт reminders-строку для непустого «Напоминание» (ТЗ §6.3 — поле
+     * deals.reminder_at удалено в v8.3, заменено таблицей reminders).
+     * Идемпотентно: не дублирует напоминание при повторном импорте.
+     */
+    private function syncReminder(int $tenantId, int $userId, Deal $deal, ParsedLeadRow $row): void
+    {
+        if ($row->reminderAt === null) {
+            return;
+        }
+
+        $exists = Reminder::query()
+            ->where('deal_id', $deal->id)
+            ->where('remind_at', $row->reminderAt)
+            ->exists();
+
+        if ($exists) {
+            return;
+        }
+
+        Reminder::create([
+            'tenant_id' => $tenantId,
+            'deal_id' => $deal->id,
+            'text' => 'Импортировано из crm.bp-gr.ru',
+            'remind_at' => $row->reminderAt,
+            'created_by' => $userId,
+        ]);
+    }
+
+    /**
+     * upsert import_unknown_statuses: инкремент occurrences, маппинг не трогаем.
+     *
+     * @param  array<string, int>  $unknown
+     */
+    private function persistUnknownStatuses(int $tenantId, int $importLogId, array $unknown): void
+    {
+        if ($unknown === []) {
+            return;
+        }
+
+        DB::transaction(function () use ($tenantId, $importLogId, $unknown): void {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            foreach ($unknown as $statusRu => $count) {
+                // Явный where(tenant_id) — defense-in-depth под BYPASSRLS queue worker
+                // (00_create_roles.sql §5): иначе increment мог бы попасть в строку
+                // чужого тенанта с тем же status_ru.
+                $existing = ImportUnknownStatus::query()
+                    ->where('tenant_id', $tenantId)
+                    ->where('status_ru', $statusRu)
+                    ->first();
+
+                if ($existing !== null) {
+                    $existing->increment('occurrences', $count);
+
+                    continue;
+                }
+
+                ImportUnknownStatus::create([
+                    'tenant_id' => $tenantId,
+                    'import_log_id' => $importLogId,
+                    'status_ru' => $statusRu,
+                    'occurrences' => $count,
+                ]);
+            }
+        });
+    }
+
+    /**
+     * Одна информационная транзакция historical_import (баланс не меняется, ТЗ §6.5).
+     */
+    private function recordHistoricalTransaction(int $tenantId, int $count): void
+    {
+        if ($count === 0) {
+            return;
+        }
+
+        DB::transaction(function () use ($tenantId, $count): void {
+            DB::statement('SET LOCAL app.current_tenant_id = '.$tenantId);
+
+            DB::table('balance_transactions')->insert([
+                'tenant_id' => $tenantId,
+                'type' => 'historical_import',
+                'amount_rub' => 0,
+                'amount_leads' => 0,
+                'description' => "Импортировано {$count} исторических сделок (баланс не списан)",
+                'created_at' => now(),
+            ]);
+        });
+    }
+}

app/app/Services/Import/ImportResult.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+/**
+ * Итог импорта одного файла.
+ */
+final readonly class ImportResult
+{
+    /**
+     * @param  array<string, int>  $unknownStatuses  статус_ru => количество вхождений
+     * @param  array<int, array{source_crm_id: int, message: string}>  $errors  ошибки upsert'а по строке (идентификатор — source_crm_id)
+     */
+    public function __construct(
+        public int $added,
+        public int $updated,
+        public int $skipped,
+        public array $unknownStatuses,
+        public array $errors,
+    ) {}
+}

app/app/Services/Import/ParsedLeadRow.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+use Carbon\CarbonImmutable;
+
+/**
+ * Одна валидная строка CSV-импорта лидов (ТЗ §6.3).
+ */
+final readonly class ParsedLeadRow
+{
+    public function __construct(
+        public int $sourceCrmId,
+        public string $projectName,
+        public ?string $projectTag,
+        public string $phone,
+        public CarbonImmutable $receivedAt,
+        public ?CarbonImmutable $reminderAt,
+        public ?string $comment,
+        public string $statusRu,
+        public ?string $contactName,
+    ) {}
+}

app/app/Services/Import/StatusRuToSlugMapper.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Import;
+
+/**
+ * Маппинг русских названий статусов воронки в slug (ТЗ §6.4).
+ *
+ * Чистый сервис без зависимостей. Tenant-специфичные переопределения
+ * неизвестных статусов накладываются вызывающим кодом (HistoricalImportService).
+ */
+class StatusRuToSlugMapper
+{
+    /** @var array<string, string> Канонический маппинг ТЗ §6.4 (14 статусов воронки). */
+    private const STATUS_RU_TO_SLUG = [
+        'Новые' => 'new',
+        'Просмотрено' => 'viewed',
+        'Проработан' => 'worked',
+        'База' => 'base',
+        'Недозвон' => 'missed',
+        'Переговоры' => 'negotiations',
+        'Ожидаем оплаты' => 'waiting_payment',
+        'Партнерка' => 'partnership',
+        'Оплачено' => 'paid',
+        'Закрыто и не реализовано' => 'closed',
+        'Тест драйв' => 'test_drive',
+        'Горячий' => 'hot',
+        'На замену' => 'replacement',
+        'Конечный недозвон' => 'final_missed',
+    ];
+
+    /**
+     * Возвращает slug или null, если статус не входит в каноническую таблицу.
+     */
+    public function toSlug(string $statusRu): ?string
+    {
+        return self::STATUS_RU_TO_SLUG[trim($statusRu)] ?? null;
+    }
+
+    /**
+     * Полная каноническая таблица — для UI wizard'а (показать варианты).
+     *
+     * @return array<string, string>
+     */
+    public function map(): array
+    {
+        return self::STATUS_RU_TO_SLUG;
+    }
+}

app/app/Services/MonthlyPartitionManager.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services;
+
+use Carbon\CarbonInterface;
+use Illuminate\Support\Facades\DB;
+use InvalidArgumentException;
+
+/**
+ * Создаёт месячные RANGE-партиции для таблиц, партиционированных по received_at.
+ *
+ * Native-замена pg_partman (расширение недоступно на Windows-стеке без сборки
+ * из исходников). Идемпотентна: партиция, которая уже есть, пропускается.
+ *
+ * Используется:
+ *   - cron `partitions:create-months` — N месяцев вперёд;
+ *   - HistoricalImportService — под исторический диапазон дат CSV.
+ */
+class MonthlyPartitionManager
+{
+    /** @var array<int, string> Таблицы, партиционированные по received_at помесячно. */
+    public const PARTITIONED_TABLES = ['deals', 'supplier_lead_costs'];
+
+    /**
+     * Гарантирует наличие месячных партиций таблицы для всех месяцев,
+     * пересекающих [$from, $to] включительно.
+     *
+     * @return int Сколько партиций реально создано (0 — все уже были).
+     */
+    public function ensureRange(string $table, CarbonInterface $from, CarbonInterface $to): int
+    {
+        if (! in_array($table, self::PARTITIONED_TABLES, true)) {
+            throw new InvalidArgumentException("Таблица '{$table}' не партиционирована помесячно");
+        }
+
+        $month = $from->copy()->startOfMonth();
+        $last = $to->copy()->startOfMonth();
+        $created = 0;
+
+        while ($month->lessThanOrEqualTo($last)) {
+            $created += $this->ensureMonth($table, $month) ? 1 : 0;
+            $month = $month->addMonth();
+        }
+
+        return $created;
+    }
+
+    /**
+     * Создаёт одну месячную партицию. Возвращает true, если партиция создана,
+     * false — если уже существовала.
+     */
+    public function ensureMonth(string $table, CarbonInterface $monthStart): bool
+    {
+        if (! in_array($table, self::PARTITIONED_TABLES, true)) {
+            throw new InvalidArgumentException("Таблица '{$table}' не партиционирована помесячно");
+        }
+
+        $start = $monthStart->copy()->startOfMonth();
+        $end = $start->copy()->addMonth();
+        $partition = sprintf('%s_%s', $table, $start->format('Y_m'));
+
+        $exists = DB::selectOne(
+            "SELECT 1 AS ok FROM pg_class WHERE relname = ? AND relkind = 'r'",
+            [$partition],
+        );
+
+        if ($exists !== null) {
+            return false;
+        }
+
+        DB::statement(sprintf(
+            "CREATE TABLE %s PARTITION OF %s FOR VALUES FROM ('%s') TO ('%s')",
+            $partition,
+            $table,
+            $start->format('Y-m-d'),
+            $end->format('Y-m-d'),
+        ));
+
+        return true;
+    }
+}

app/app/Services/Reports/Providers/BillingSummaryProvider.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Reports\Providers;
+
+use App\Models\ReportJob;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * billing_summary — агрегат balance_transactions по типу операции (audit F1).
+ *
+ * Группировка по balance_transactions.type; count + SUM(amount_rub). Тип
+ * операции переводится в человекочитаемую метку. parameters: date_from,
+ * date_to (Y-m-d) — фильтр по created_at.
+ *
+ * RLS-обёртка SET LOCAL app.current_tenant_id (balance_transactions имеет RLS
+ * tenant_isolation) + явный where('tenant_id') — паттерн BillingController.
+ */
+class BillingSummaryProvider implements ReportDataProvider
+{
+    /** Канон-типы balance_transactions.type → RU-метка (schema §7.6 CHECK). */
+    private const TYPE_LABELS = [
+        'trial_bonus' => 'Стартовый бонус',
+        'topup' => 'Пополнение',
+        'lead_charge' => 'Списание за лиды',
+        'refund' => 'Возврат',
+        'manual_adjustment' => 'Ручная корректировка',
+        'historical_import' => 'Импорт истории',
+        'chargeback_writedown' => 'Chargeback — списание в долг',
+        'chargeback_repayment' => 'Chargeback — погашение долга',
+    ];
+
+    public function headers(): array
+    {
+        return ['Тип операции', 'Количество', 'Сумма (₽)'];
+    }
+
+    public function rows(ReportJob $job): array
+    {
+        $params = $job->parameters ?? [];
+        $dateFrom = Carbon::parse($params['date_from'])->startOfDay();
+        $dateTo = Carbon::parse($params['date_to'])->endOfDay();
+
+        return DB::transaction(function () use ($job, $dateFrom, $dateTo): array {
+            DB::statement('SET LOCAL app.current_tenant_id = '.(int) $job->tenant_id);
+
+            $rows = DB::table('balance_transactions')
+                ->where('tenant_id', $job->tenant_id)
+                ->whereBetween('created_at', [$dateFrom, $dateTo])
+                ->groupBy('type')
+                ->orderBy('type')
+                ->selectRaw('type, COUNT(*) AS cnt, COALESCE(SUM(amount_rub), 0) AS sum_rub')
+                ->get();
+
+            return $rows->map(function ($row): array {
+                $label = self::TYPE_LABELS[$row->type] ?? (string) $row->type;
+
+                return [$label, (int) $row->cnt, (string) $row->sum_rub];
+            })->all();
+        });
+    }
+
+    public function slug(): string
+    {
+        return 'billing';
+    }
+}

app/app/Services/Reports/Providers/ManagersSummaryProvider.php

@@ -0,0 +1,76 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Reports\Providers;
+
+use App\Models\ReportJob;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * managers_summary — агрегат сделок по менеджерам за период (audit F1).
+ *
+ * Группировка по deals.manager_id; неназначенные (manager_id IS NULL) сводятся
+ * в строку «Не назначен». «Оплачено» = status='paid' (won-статус воронки, как
+ * в DashboardController). Конверсия = paid / total * 100, округление до 0.1.
+ *
+ * parameters: date_from, date_to (Y-m-d). Исключаются soft-deleted
+ * (deleted_at IS NULL) и тестовые (is_test=false) сделки. RLS-обёртка
+ * SET LOCAL app.current_tenant_id — паттерн DealsExportProvider.
+ */
+class ManagersSummaryProvider implements ReportDataProvider
+{
+    public function headers(): array
+    {
+        return ['Менеджер', 'Всего сделок', 'Оплачено', 'Конверсия (%)'];
+    }
+
+    public function rows(ReportJob $job): array
+    {
+        $params = $job->parameters ?? [];
+        $dateFrom = Carbon::parse($params['date_from'])->startOfDay();
+        $dateTo = Carbon::parse($params['date_to'])->endOfDay();
+
+        return DB::transaction(function () use ($job, $dateFrom, $dateTo): array {
+            DB::statement('SET LOCAL app.current_tenant_id = '.(int) $job->tenant_id);
+
+            $rows = DB::table('deals')
+                ->leftJoin('users', 'deals.manager_id', '=', 'users.id')
+                ->where('deals.tenant_id', $job->tenant_id)
+                ->whereNull('deals.deleted_at')
+                ->where('deals.is_test', false)
+                ->whereBetween('deals.received_at', [$dateFrom, $dateTo])
+                ->groupBy('deals.manager_id', 'users.first_name', 'users.last_name', 'users.email')
+                ->orderByRaw('COUNT(*) DESC')
+                ->orderBy('deals.manager_id')
+                ->selectRaw(
+                    "deals.manager_id,
+                     users.first_name, users.last_name, users.email,
+                     COUNT(*) AS total,
+                     COUNT(*) FILTER (WHERE deals.status = 'paid') AS paid"
+                )
+                ->get();
+
+            return $rows->map(function ($row): array {
+                $name = trim(($row->first_name ?? '').' '.($row->last_name ?? ''));
+                if ($name === '') {
+                    $name = (string) ($row->email ?? '');
+                }
+                if ($name === '') {
+                    $name = 'Не назначен';
+                }
+                $total = (int) $row->total;
+                $paid = (int) $row->paid;
+                $conversion = $total > 0 ? round($paid / $total * 100, 1) : 0.0;
+
+                return [$name, $total, $paid, $conversion];
+            })->all();
+        });
+    }
+
+    public function slug(): string
+    {
+        return 'managers';
+    }
+}

app/app/Services/Reports/Providers/SourcesSummaryProvider.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services\Reports\Providers;
+
+use App\Models\ReportJob;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * sources_summary — агрегат сделок по источнику (utm_source) за период (audit F1).
+ *
+ * Группировка по deals.utm_source; сделки без метки (NULL/пусто) сводятся в
+ * строку «Прямые / без метки». «Оплачено» = status='paid'. Конверсия =
+ * paid / total * 100, округление до 0.1.
+ *
+ * parameters: date_from, date_to (Y-m-d). Исключаются soft-deleted и тестовые
+ * сделки. RLS-обёртка SET LOCAL app.current_tenant_id — паттерн DealsExportProvider.
+ */
+class SourcesSummaryProvider implements ReportDataProvider
+{
+    public function headers(): array
+    {
+        return ['Источник', 'Всего сделок', 'Оплачено', 'Конверсия (%)'];
+    }
+
+    public function rows(ReportJob $job): array
+    {
+        $params = $job->parameters ?? [];
+        $dateFrom = Carbon::parse($params['date_from'])->startOfDay();
+        $dateTo = Carbon::parse($params['date_to'])->endOfDay();
+
+        return DB::transaction(function () use ($job, $dateFrom, $dateTo): array {
+            DB::statement('SET LOCAL app.current_tenant_id = '.(int) $job->tenant_id);
+
+            $rows = DB::table('deals')
+                ->where('tenant_id', $job->tenant_id)
+                ->whereNull('deleted_at')
+                ->where('is_test', false)
+                ->whereBetween('received_at', [$dateFrom, $dateTo])
+                ->groupBy('utm_source')
+                ->orderByRaw('COUNT(*) DESC')
+                ->orderBy('utm_source')
+                ->selectRaw(
+                    "utm_source,
+                     COUNT(*) AS total,
+                     COUNT(*) FILTER (WHERE status = 'paid') AS paid"
+                )
+                ->get();
+
+            return $rows->map(function ($row): array {
+                $source = $row->utm_source !== null && trim((string) $row->utm_source) !== ''
+                    ? (string) $row->utm_source
+                    : 'Прямые / без метки';
+                $total = (int) $row->total;
+                $paid = (int) $row->paid;
+                $conversion = $total > 0 ? round($paid / $total * 100, 1) : 0.0;
+
+                return [$source, $total, $paid, $conversion];
+            })->all();
+        });
+    }
+
+    public function slug(): string
+    {
+        return 'sources';
+    }
+}

app/app/Services/Reports/ReportGeneratorRegistry.php

@@ -10,23 +10,28 @@ use App\Services\Reports\Formatters\JsonFormatter;
 use App\Services\Reports\Formatters\PdfStubFormatter;
 use App\Services\Reports\Formatters\ReportFormatter;
 use App\Services\Reports\Formatters\XlsxFormatter;
+use App\Services\Reports\Providers\BillingSummaryProvider;
 use App\Services\Reports\Providers\DealsExportProvider;
+use App\Services\Reports\Providers\ManagersSummaryProvider;
 use App\Services\Reports\Providers\ReportDataProvider;
+use App\Services\Reports\Providers\SourcesSummaryProvider;
 use InvalidArgumentException;
 
 /**
  * Резолвит ReportDataProvider по `type` и ReportFormatter по `format`.
  *
- * Этап 2 (текущий): 1 provider × 4 formatter = 4 комбинации
- *   (deals_export × csv|xlsx|json|pdf-stub).
- *
- * Этап 2b расширит до 4 × 4 = 16 (managers_summary, sources_summary,
- * billing_summary). Для PDF на MVP — stub, fallback'ит в RuntimeException.
+ * 4 provider'а (deals_export, managers_summary, sources_summary,
+ * billing_summary) × 4 formatter'а (csv, xlsx, json, pdf). PDF на MVP —
+ * stub: PdfStubFormatter кидает RuntimeException → GenerateReportJob
+ * ловит → failed-job (intended, Post-MVP).
  */
 class ReportGeneratorRegistry
 {
     public function __construct(
         private readonly DealsExportProvider $dealsExport,
+        private readonly ManagersSummaryProvider $managersSummary,
+        private readonly SourcesSummaryProvider $sourcesSummary,
+        private readonly BillingSummaryProvider $billingSummary,
         private readonly CsvFormatter $csv,
         private readonly XlsxFormatter $xlsx,
         private readonly JsonFormatter $json,
@@ -37,6 +42,9 @@ class ReportGeneratorRegistry
     {
         return match ($type) {
             'deals_export' => $this->dealsExport,
+            'managers_summary' => $this->managersSummary,
+            'sources_summary' => $this->sourcesSummary,
+            'billing_summary' => $this->billingSummary,
             default => throw new InvalidArgumentException("Тип отчёта не реализован: {$type}"),
         };
     }
@@ -54,18 +62,10 @@ class ReportGeneratorRegistry
 
     public function isSupported(string $type, string $format): bool
     {
-        if (! in_array($type, ReportJob::TYPES, true) || ! in_array($format, ReportJob::FORMATS, true)) {
-            return false;
-        }
-
-        // Этап 2: только deals_export (этап 2b добавит остальные).
-        $supportedTypes = ['deals_export'];
-        if (! in_array($type, $supportedTypes, true)) {
-            return false;
-        }
-
-        // PDF — stub: validates, но генерация даёт failed-job (intended).
-        // Считаем «поддерживается» — пусть GenerateReportJob сам catch'ит RuntimeException.
-        return true;
+        // Все 4 типа ReportJob::TYPES реализованы (F1, 2026-05-16).
+        // PDF валидируется, но PdfStubFormatter кидает RuntimeException →
+        // GenerateReportJob ловит → failed-job (intended, Post-MVP).
+        return in_array($type, ReportJob::TYPES, true)
+            && in_array($format, ReportJob::FORMATS, true);
     }
 }

app/bootstrap/app.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Http\Middleware\EnsureSaasAdmin;
 use App\Http\Middleware\SetTenantContext;
 use Illuminate\Foundation\Application;
 use Illuminate\Foundation\Configuration\Exceptions;
@@ -18,6 +19,7 @@ return Application::configure(basePath: dirname(__DIR__))
 
         $middleware->alias([
             'tenant' => SetTenantContext::class,
+            'saas-admin' => EnsureSaasAdmin::class,
         ]);
 
         // Webhook receive endpoint (POST /api/webhook/{token}) не должен требовать

app/composer.json

@@ -65,6 +65,7 @@
         "stan": "@php vendor/bin/phpstan analyse --memory-limit=512M",
         "mutation": "@php vendor/bin/infection --threads=2 --min-msi=50",
         "audit-offline": "@composer audit --locked",
+        "demo:seed": "@php artisan db:seed --class=DemoSeeder --force",
         "ide-helper": [
             "@php artisan ide-helper:generate",
             "@php artisan ide-helper:meta"

app/database/factories/ApiKeyFactory.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use App\Models\ApiKey;
+use App\Models\Tenant;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+
+/**
+ * @extends Factory<ApiKey>
+ */
+class ApiKeyFactory extends Factory
+{
+    protected $model = ApiKey::class;
+
+    public function definition(): array
+    {
+        return [
+            'tenant_id' => Tenant::factory(),
+            'user_id' => User::factory(),
+            'name' => 'API-ключ',
+            'key_hash' => Hash::make(Str::random(48)),
+            'key_prefix' => 'lpkapi_'.Str::lower(Str::random(3)),
+            'scopes' => ['read'],
+            'last_used_at' => null,
+            'expires_at' => now()->addYear(),
+            'is_active' => true,
+            'created_at' => now(),
+        ];
+    }
+}

app/database/factories/BalanceTransactionFactory.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use App\Models\BalanceTransaction;
+use App\Models\Tenant;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<BalanceTransaction>
+ */
+class BalanceTransactionFactory extends Factory
+{
+    protected $model = BalanceTransaction::class;
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        return [
+            'tenant_id' => Tenant::factory(),
+            'type' => BalanceTransaction::TYPE_TOPUP,
+            'amount_rub' => '100.00',
+            'amount_leads' => 0,
+            'balance_rub_after' => '100.00',
+            'balance_leads_after' => 0,
+            'description' => 'Тестовая транзакция',
+            'created_at' => now(),
+        ];
+    }
+}

app/database/factories/ImportLogFactory.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use App\Models\ImportLog;
+use App\Models\Tenant;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/** @extends Factory<ImportLog> */
+class ImportLogFactory extends Factory
+{
+    protected $model = ImportLog::class;
+
+    public function definition(): array
+    {
+        return [
+            'tenant_id' => Tenant::factory(),
+            'user_id' => User::factory(),
+            'filename' => 'leads-export.csv',
+            'file_path' => 'imports/1/'.$this->faker->uuid().'.csv',
+            'status' => 'pending',
+            'entity_type' => 'leads',
+            'source_system' => 'crm.bp-gr.ru',
+            'dry_run' => false,
+        ];
+    }
+}

app/database/factories/ImportUnknownStatusFactory.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use App\Models\ImportUnknownStatus;
+use App\Models\Tenant;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/** @extends Factory<ImportUnknownStatus> */
+class ImportUnknownStatusFactory extends Factory
+{
+    protected $model = ImportUnknownStatus::class;
+
+    public function definition(): array
+    {
+        return [
+            'tenant_id' => Tenant::factory(),
+            'status_ru' => $this->faker->unique()->word(),
+            'occurrences' => $this->faker->numberBetween(1, 20),
+            'mapped_to_slug' => null,
+        ];
+    }
+}

app/database/factories/OutboundWebhookSubscriptionFactory.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Database\Factories;
+
+use App\Models\OutboundWebhookSubscription;
+use App\Models\Tenant;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+
+/**
+ * @extends Factory<OutboundWebhookSubscription>
+ */
+class OutboundWebhookSubscriptionFactory extends Factory
+{
+    protected $model = OutboundWebhookSubscription::class;
+
+    public function definition(): array
+    {
+        return [
+            'tenant_id' => Tenant::factory(),
+            'user_id' => User::factory(),
+            'name' => 'Webhook',
+            'target_url' => 'https://'.fake()->domainName().'/webhook',
+            'secret_hash' => Hash::make('whsec_'.Str::random(40)),
+            'secret_prefix' => 'whsec_'.Str::lower(Str::random(4)),
+            'events' => ['deal.created', 'deal.status_changed'],
+            'is_active' => true,
+        ];
+    }
+}

app/database/migrations/2026_05_16_120000_sprint4_historical_import_schema.php

@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Sprint 4 (H1+H2) — историческая миграция лидов §6.
+ *
+ * H1: новая таблица import_unknown_statuses (tenant-level resolved mappings).
+ * H2: enrichment import_log — +5 колонок.
+ *
+ * Guard'ы: migrate:fresh грузит schema.sql v8.21+ (где delta уже есть) до миграций,
+ * поэтому каждый кусок применяется только при отсутствии.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        foreach ([
+            'entity_type' => "ALTER TABLE import_log ADD COLUMN entity_type VARCHAR(20) NOT NULL DEFAULT 'leads' CHECK (entity_type IN ('leads','projects'))",
+            'source_system' => "ALTER TABLE import_log ADD COLUMN source_system VARCHAR(50) NOT NULL DEFAULT 'crm.bp-gr.ru'",
+            'mapping_config' => 'ALTER TABLE import_log ADD COLUMN mapping_config JSONB',
+            'unknown_statuses_count' => 'ALTER TABLE import_log ADD COLUMN unknown_statuses_count INT NOT NULL DEFAULT 0',
+            'dry_run' => 'ALTER TABLE import_log ADD COLUMN dry_run BOOLEAN NOT NULL DEFAULT FALSE',
+        ] as $column => $ddl) {
+            if (! Schema::hasColumn('import_log', $column)) {
+                DB::statement($ddl);
+            }
+        }
+
+        if (! Schema::hasTable('import_unknown_statuses')) {
+            DB::statement(<<<'SQL'
+                CREATE TABLE import_unknown_statuses (
+                    id              BIGSERIAL PRIMARY KEY,
+                    tenant_id       BIGINT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
+                    import_log_id   BIGINT REFERENCES import_log(id) ON DELETE SET NULL,
+                    status_ru       VARCHAR(100) NOT NULL,
+                    occurrences     INT NOT NULL DEFAULT 0,
+                    mapped_to_slug  VARCHAR(50) REFERENCES lead_statuses(slug),
+                    resolved_at     TIMESTAMPTZ,
+                    resolved_by     BIGINT REFERENCES users(id),
+                    created_at      TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+                    updated_at      TIMESTAMPTZ,
+                    UNIQUE (tenant_id, status_ru)
+                )
+                SQL);
+
+            DB::statement(
+                'CREATE INDEX idx_import_unknown_statuses_unresolved
+                 ON import_unknown_statuses (tenant_id) WHERE mapped_to_slug IS NULL'
+            );
+
+            DB::statement('ALTER TABLE import_unknown_statuses ENABLE ROW LEVEL SECURITY');
+            DB::statement(
+                "CREATE POLICY tenant_isolation ON import_unknown_statuses
+                 USING (tenant_id = current_setting('app.current_tenant_id')::bigint)"
+            );
+        }
+    }
+
+    public function down(): void
+    {
+        // down() не симметричен: на проекте rollback применяется только после
+        // migrate:fresh (см. add_archived_at_to_projects). Для отката v8.21 —
+        // отдельный schema-bump, не эта миграция.
+        DB::statement('DROP TABLE IF EXISTS import_unknown_statuses');
+
+        foreach (['entity_type', 'source_system', 'mapping_config', 'unknown_statuses_count', 'dry_run'] as $column) {
+            if (Schema::hasColumn('import_log', $column)) {
+                Schema::table('import_log', fn ($table) => $table->dropColumn($column));
+            }
+        }
+    }
+};

app/database/seeders/DemoSeeder.php

@@ -14,6 +14,16 @@ class DemoSeeder extends Seeder
 {
     public function run(): void
     {
+        // DemoSeeder создаёт демо-данные и НЕ должен исполняться в production.
+        // DatabaseSeeder вызывает его только в local/testing — этот guard
+        // дополнительно защищает прямой вызов `db:seed --class=DemoSeeder`
+        // (в т.ч. через `composer demo:seed`).
+        if (app()->isProduction()) {
+            $this->command->warn('DemoSeeder пропущен: запрещён в production.');
+
+            return;
+        }
+
         $tenant = Tenant::query()->where('subdomain', 'demo')->first()
             ?? Tenant::factory()->create([
                 'subdomain' => 'demo',

app/phpstan-baseline.neon

@@ -78,12 +78,6 @@ parameters:
 			count: 1
 			path: app/Http/Middleware/SetTenantContext.php
 
-		-
-			message: '#^Access to an undefined property App\\Models\\Project\:\:\$archived_at\.$#'
-			identifier: property.notFound
-			count: 1
-			path: app/Http/Resources/ProjectResource.php
-
 		-
 			message: '#^Using nullsafe property access "\?\-\>name" on left side of \?\? is unnecessary\. Use \-\> instead\.$#'
 			identifier: nullsafe.neverNull
@@ -102,18 +96,18 @@ parameters:
 			count: 1
 			path: app/Services/NotificationService.php
 
-		-
-			message: '#^Access to an undefined property App\\Models\\Project\:\:\$archived_at\.$#'
-			identifier: property.notFound
-			count: 1
-			path: app/Services/Project/ProjectService.php
-
 		-
 			message: '#^Match expression does not handle remaining value\: string$#'
 			identifier: match.unhandled
 			count: 1
 			path: app/Services/Project/ProjectService.php
 
+		-
+			message: '#^Return type \(array\<string, mixed\>\) of method Database\\Factories\\BalanceTransactionFactory\:\:definition\(\) should be compatible with return type \(array\<model property of App\\Models\\BalanceTransaction, mixed\>\) of method Illuminate\\Database\\Eloquent\\Factories\\Factory\<App\\Models\\BalanceTransaction\>\:\:definition\(\)$#'
+			identifier: method.childReturnType
+			count: 1
+			path: database/factories/BalanceTransactionFactory.php
+
 		-
 			message: '#^Return type \(array\<string, mixed\>\) of method Database\\Factories\\ProjectFactory\:\:definition\(\) should be compatible with return type \(array\<model property of App\\Models\\Project, mixed\>\) of method Illuminate\\Database\\Eloquent\\Factories\\Factory\<App\\Models\\Project\>\:\:definition\(\)$#'
 			identifier: method.childReturnType
@@ -186,12 +180,54 @@ parameters:
 			count: 3
 			path: tests/Feature/Admin/AdminSuppliersControllerTest.php
 
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/AdminBillingActionsTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:patchJson\(\)\.$#'
+			identifier: method.notFound
+			count: 7
+			path: tests/Feature/AdminBillingActionsTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/AdminBillingActionsTest.php
+
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
 			identifier: method.notFound
 			count: 10
 			path: tests/Feature/AdminBillingIndexTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$adminId\.$#'
+			identifier: property.notFound
+			count: 4
+			path: tests/Feature/AdminIncidentRknNotifyTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 4
+			path: tests/Feature/AdminIncidentRknNotifyTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$adminId\.$#'
+			identifier: property.notFound
+			count: 5
+			path: tests/Feature/AdminIncidentShowTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 5
+			path: tests/Feature/AdminIncidentShowTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$adminId\.$#'
 			identifier: property.notFound
@@ -252,6 +288,36 @@ parameters:
 			count: 14
 			path: tests/Feature/Api/ProjectBulkActionsTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 7
+			path: tests/Feature/ApiKeyControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 5
+			path: tests/Feature/ApiKeyControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/ApiKeyControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 4
+			path: tests/Feature/ApiKeyControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/ApiKeyControllerTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
@@ -463,16 +529,58 @@ parameters:
 			path: tests/Feature/Auth/TwoFactorTest.php
 
 		-
-			message: '#^Access to an undefined property App\\Models\\LeadCharge\:\:\$charge_source\.$#'
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 2
-			path: tests/Feature/Billing/LedgerServiceTest.php
+			count: 1
+			path: tests/Feature/Auth/UpdateProfileTest.php
 
 		-
-			message: '#^Access to an undefined property App\\Models\\Tenant\:\:\$delivered_in_month\.$#'
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
 			identifier: property.notFound
-			count: 3
-			path: tests/Feature/Billing/LedgerServiceTest.php
+			count: 4
+			path: tests/Feature/Auth/UpdateProfileTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Auth/UpdateProfileTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Auth/UpdateProfileTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:patchJson\(\)\.$#'
+			identifier: method.notFound
+			count: 6
+			path: tests/Feature/Auth/UpdateProfileTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 12
+			path: tests/Feature/Billing/BillingOverviewControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/Billing/BillingOverviewControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Billing/BillingOverviewControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 18
+			path: tests/Feature/Billing/BillingOverviewControllerTest.php
 
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$ledger\.$#'
@@ -528,6 +636,36 @@ parameters:
 			count: 1
 			path: tests/Feature/Billing/TenantChargesControllerTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 5
+			path: tests/Feature/Billing/TopupControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 2
+			path: tests/Feature/Billing/TopupControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Billing/TopupControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:assertDatabaseHas\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Billing/TopupControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 8
+			path: tests/Feature/Billing/TopupControllerTest.php
+
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:artisan\(\)\.$#'
 			identifier: method.notFound
@@ -540,22 +678,34 @@ parameters:
 			count: 2
 			path: tests/Feature/Console/ResetDeliveredTodayCommandTest.php
 
-		-
-			message: '#^Access to an undefined property App\\Models\\Tenant\:\:\$delivered_in_month\.$#'
-			identifier: property.notFound
-			count: 3
-			path: tests/Feature/Console/ResetMonthlyCountersCommandTest.php
-
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:artisan\(\)\.$#'
 			identifier: method.notFound
 			count: 1
 			path: tests/Feature/Console/ResetMonthlyCountersCommandTest.php
 
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 9
+			path: tests/Feature/DashboardSummaryTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 37
+			count: 15
+			path: tests/Feature/DealCreateTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealCreateTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealCreateTest.php
 
 		-
@@ -579,7 +729,19 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 20
+			count: 11
+			path: tests/Feature/DealDestroyTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealDestroyTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealDestroyTest.php
 
 		-
@@ -621,13 +783,25 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 50
+			count: 30
+			path: tests/Feature/DealIndexTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealIndexTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealIndexTest.php
 
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
 			identifier: method.notFound
-			count: 22
+			count: 21
 			path: tests/Feature/DealIndexTest.php
 
 		-
@@ -645,7 +819,19 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 18
+			count: 9
+			path: tests/Feature/DealRestoreTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealRestoreTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealRestoreTest.php
 
 		-
@@ -681,19 +867,31 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project\.$#'
 			identifier: property.notFound
-			count: 7
+			count: 6
 			path: tests/Feature/DealShowTest.php
 
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 20
+			count: 13
+			path: tests/Feature/DealShowTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealShowTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealShowTest.php
 
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
 			identifier: method.notFound
-			count: 8
+			count: 7
 			path: tests/Feature/DealShowTest.php
 
 		-
@@ -711,7 +909,19 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 12
+			count: 7
+			path: tests/Feature/DealTransitionTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealTransitionTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealTransitionTest.php
 
 		-
@@ -735,19 +945,31 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project\.$#'
 			identifier: property.notFound
-			count: 10
+			count: 9
 			path: tests/Feature/DealUpdateTest.php
 
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 24
+			count: 15
+			path: tests/Feature/DealUpdateTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/DealUpdateTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
 			path: tests/Feature/DealUpdateTest.php
 
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:patchJson\(\)\.$#'
 			identifier: method.notFound
-			count: 10
+			count: 9
 			path: tests/Feature/DealUpdateTest.php
 
 		-
@@ -786,6 +1008,90 @@ parameters:
 			count: 17
 			path: tests/Feature/ImpersonationTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$service\.$#'
+			identifier: property.notFound
+			count: 10
+			path: tests/Feature/Import/HistoricalImportServiceTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 23
+			path: tests/Feature/Import/HistoricalImportServiceTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 20
+			path: tests/Feature/Import/HistoricalImportServiceTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 3
+			path: tests/Feature/Import/ImportCompletedNotificationTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 3
+			path: tests/Feature/Import/ImportCompletedNotificationTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 12
+			path: tests/Feature/Import/ImportControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 3
+			path: tests/Feature/Import/ImportControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/Import/ImportControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 4
+			path: tests/Feature/Import/ImportControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 5
+			path: tests/Feature/Import/ImportControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 9
+			path: tests/Feature/Import/ImportLeadsJobTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 4
+			path: tests/Feature/Import/ImportLeadsJobTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 4
+			path: tests/Feature/Import/ImportModelsTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 2
+			path: tests/Feature/Import/ImportModelsTest.php
+
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
 			identifier: method.notFound
@@ -816,6 +1122,12 @@ parameters:
 			count: 16
 			path: tests/Feature/LookupsTest.php
 
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/LookupsTest.php
+
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
 			identifier: method.notFound
@@ -882,12 +1194,6 @@ parameters:
 			count: 6
 			path: tests/Feature/Plan5/Jobs/SyncSupplierProjectJobTest.php
 
-		-
-			message: '#^Access to an undefined property App\\Models\\Project\:\:\$archived_at\.$#'
-			identifier: property.notFound
-			count: 2
-			path: tests/Feature/Plan5/Projects/ProjectsActionsTest.php
-
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
 			identifier: method.notFound
@@ -963,7 +1269,49 @@ parameters:
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
 			identifier: property.notFound
-			count: 25
+			count: 9
+			path: tests/Feature/Reports/BillingSummaryProviderTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project\.$#'
+			identifier: property.notFound
+			count: 8
+			path: tests/Feature/Reports/ManagersSummaryProviderTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 14
+			path: tests/Feature/Reports/ManagersSummaryProviderTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 20
+			path: tests/Feature/Reports/ReportDownloadTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 14
+			path: tests/Feature/Reports/ReportDownloadTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/Reports/ReportDownloadTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:get\(\)\.$#'
+			identifier: method.notFound
+			count: 8
+			path: tests/Feature/Reports/ReportDownloadTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 31
 			path: tests/Feature/Reports/ReportJobControllerTest.php
 
 		-
@@ -987,7 +1335,7 @@ parameters:
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
 			identifier: method.notFound
-			count: 12
+			count: 14
 			path: tests/Feature/Reports/ReportJobControllerTest.php
 
 		-
@@ -1032,6 +1380,18 @@ parameters:
 			count: 12
 			path: tests/Feature/Reports/ReportLifecycleTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project\.$#'
+			identifier: property.notFound
+			count: 8
+			path: tests/Feature/Reports/SourcesSummaryProviderTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 12
+			path: tests/Feature/Reports/SourcesSummaryProviderTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project1Id\.$#'
 			identifier: property.notFound
@@ -1056,6 +1416,18 @@ parameters:
 			count: 5
 			path: tests/Feature/RlsSmokeTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$app\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/SaasAdminMiddlewareTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 2
+			path: tests/Feature/SaasAdminMiddlewareTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$project\.$#'
 			identifier: property.notFound
@@ -1116,18 +1488,6 @@ parameters:
 			count: 7
 			path: tests/Feature/Supplier/RetryFailedSupplierJobsCommandTest.php
 
-		-
-			message: '#^Access to an undefined property App\\Models\\LeadCharge\:\:\$charge_source\.$#'
-			identifier: property.notFound
-			count: 2
-			path: tests/Feature/Supplier/RouteSupplierLeadJobBillingTest.php
-
-		-
-			message: '#^Access to an undefined property App\\Models\\Tenant\:\:\$delivered_in_month\.$#'
-			identifier: property.notFound
-			count: 2
-			path: tests/Feature/Supplier/RouteSupplierLeadJobBillingTest.php
-
 		-
 			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:seed\(\)\.$#'
 			identifier: method.notFound
@@ -1158,6 +1518,48 @@ parameters:
 			count: 14
 			path: tests/Feature/WebhookReceiveTest.php
 
+		-
+			message: '#^Access to an undefined property Pest\\Mixins\\Expectation\<mixed\>\:\:\$not\.$#'
+			identifier: property.notFound
+			count: 1
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$tenant\.$#'
+			identifier: property.notFound
+			count: 7
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$user\.$#'
+			identifier: property.notFound
+			count: 5
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:actingAs\(\)\.$#'
+			identifier: method.notFound
+			count: 1
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:getJson\(\)\.$#'
+			identifier: method.notFound
+			count: 4
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:postJson\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
+		-
+			message: '#^Call to an undefined method Pest\\PendingCalls\\TestCall\:\:putJson\(\)\.$#'
+			identifier: method.notFound
+			count: 3
+			path: tests/Feature/WebhookSettingsControllerTest.php
+
 		-
 			message: '#^Access to an undefined property Pest\\PendingCalls\\TestCall\:\:\$resolver\.$#'
 			identifier: property.notFound

app/resources/js/api/admin.ts

@@ -331,3 +331,100 @@ export async function updateSystemSetting(
     );
     return data;
 }
+
+// === SaaS-admin → Биллинг: row-actions (Sprint 3D G4) ===
+
+export interface AdminTariffPlan {
+    id: number;
+    name: string;
+    price_monthly: string;
+}
+
+export async function listAdminTariffPlans(): Promise<AdminTariffPlan[]> {
+    const { data } = await apiClient.get<{ plans: AdminTariffPlan[] }>('/api/admin/billing/tariff-plans');
+    return data.plans;
+}
+
+export async function updateTenantStatus(
+    id: number,
+    status: 'active' | 'suspended',
+    reason: string,
+): Promise<{ id: number; status: string }> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.patch<{ id: number; status: string }>(
+        `/api/admin/billing/tenants/${id}/status`,
+        { status, reason },
+    );
+    return data;
+}
+
+export async function refundTenant(
+    id: number,
+    amountRub: number,
+    reason: string,
+): Promise<{ id: number; balance_rub: string; transaction_id: number }> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.post<{ id: number; balance_rub: string; transaction_id: number }>(
+        `/api/admin/billing/tenants/${id}/refund`,
+        { amount_rub: amountRub, reason },
+    );
+    return data;
+}
+
+export async function changeTenantTariff(
+    id: number,
+    tariffId: number,
+    reason: string,
+): Promise<{ id: number; tariff_id: number; tariff_name: string }> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.patch<{ id: number; tariff_id: number; tariff_name: string }>(
+        `/api/admin/billing/tenants/${id}/tariff`,
+        { tariff_id: tariffId, reason },
+    );
+    return data;
+}
+
+// === SaaS-admin → Инциденты: detail-view + РКН-notify (Sprint 3D G5/G6) ===
+
+export interface ApiIncidentAffectedTenant {
+    id: number;
+    organization_name: string;
+}
+
+export interface ApiAdminIncidentDetail {
+    id: number;
+    incident_id: string;
+    type: string;
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    summary: string;
+    root_cause: string | null;
+    postmortem_url: string | null;
+    started_at: string;
+    detected_at: string;
+    resolved_at: string | null;
+    status: 'open' | 'investigating' | 'resolved';
+    affected_tenants: ApiIncidentAffectedTenant[];
+    affected_users_count: number | null;
+    notification_sent_at: string | null;
+    rkn_notified: boolean;
+    rkn_notified_at: string | null;
+    rkn_deadline_at: string | null;
+    created_by_admin: string | null;
+    closed_by_admin: string | null;
+    created_at: string | null;
+    updated_at: string | null;
+}
+
+export async function getAdminIncidentDetail(id: number): Promise<ApiAdminIncidentDetail> {
+    const { data } = await apiClient.get<{ incident: ApiAdminIncidentDetail }>(`/api/admin/incidents/${id}`);
+    return data.incident;
+}
+
+export async function notifyIncidentRkn(id: number): Promise<ApiAdminIncidentDetail> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.post<{ incident: ApiAdminIncidentDetail }>(
+        `/api/admin/incidents/${id}/rkn-notify`,
+        {},
+    );
+    return data.incident;
+}

app/resources/js/api/apiKeys.ts

@@ -0,0 +1,32 @@
+import { apiClient, ensureCsrfCookie } from './client';
+
+/**
+ * API-ключи тенанта (audit D2/D3). Backend: ApiKeyController.
+ * Полный ключ доступен только в ответе regenerateApiKey().
+ */
+export interface ApiKeyInfo {
+    id: number;
+    name: string;
+    key_prefix: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    created_at: string | null;
+}
+
+export interface RegeneratedApiKey {
+    id: number;
+    name: string;
+    key: string;
+    key_prefix: string;
+}
+
+export async function listApiKeys(): Promise<ApiKeyInfo[]> {
+    const { data } = await apiClient.get<{ data: ApiKeyInfo[] }>('/api/api-keys');
+    return data.data;
+}
+
+export async function regenerateApiKey(): Promise<RegeneratedApiKey> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.post<RegeneratedApiKey>('/api/api-keys/regenerate');
+    return data;
+}

app/resources/js/api/auth.ts

@@ -25,6 +25,8 @@ export interface AuthUser {
     email: string;
     first_name: string | null;
     last_name: string | null;
+    phone?: string | null;
+    timezone?: string | null;
     tenant_id: number;
     totp_enabled: boolean;
     last_login_at: string | null;
@@ -151,3 +153,16 @@ export async function updateNotificationPreferences(payload: UpdateNotificationP
     const { data } = await apiClient.patch<{ user: AuthUser }>('/api/auth/me/notification-preferences', payload);
     return data.user;
 }
+
+export interface UpdateProfilePayload {
+    first_name: string;
+    last_name: string;
+    phone: string | null;
+    timezone: string;
+}
+
+export async function updateProfile(payload: UpdateProfilePayload): Promise<AuthUser> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.patch<{ user: AuthUser }>('/api/auth/me', payload);
+    return data.user;
+}

app/resources/js/api/billing.ts

@@ -0,0 +1,90 @@
+import { apiClient, ensureCsrfCookie } from './client';
+
+/**
+ * API-модуль биллинга (Sprint 2 Plan C).
+ *
+ * Эндпоинты под [auth:sanctum, tenant]: GET wallet/transactions/invoices
+ * (E3), POST topup (E1 — добавляется в Task 5). GET'ы не требуют CSRF-cookie.
+ */
+
+/** Тариф в составе ответа GET /api/billing/wallet. */
+export interface WalletTariff {
+    code: string;
+    name: string;
+    price_monthly: string | null;
+    billing_model: string;
+    features: string[];
+}
+
+/** Ответ GET /api/billing/wallet — кошелёк тенанта. */
+export interface Wallet {
+    balance_rub: string;
+    balance_leads: number;
+    runway_days: number | null;
+    tariff: WalletTariff | null;
+}
+
+/** GET /api/billing/wallet — балансы + текущий тариф + runway. */
+export async function getWallet(): Promise<Wallet> {
+    const { data } = await apiClient.get<Wallet>('/api/billing/wallet');
+    return data;
+}
+
+/** Строка истории транзакций (GET /api/billing/transactions). */
+export interface BillingTransaction {
+    id: number;
+    code: string;
+    type: string;
+    description: string | null;
+    amount_rub: string;
+    amount_leads: number;
+    balance_rub_after: string | null;
+    created_at: string;
+}
+
+/** Пагинированный ответ GET /api/billing/transactions. */
+export interface TransactionsPage {
+    data: BillingTransaction[];
+    meta: { current_page: number; last_page: number; total: number; per_page: number };
+}
+
+/** Счёт тенанта (GET /api/billing/invoices). */
+export interface BillingInvoice {
+    id: number;
+    invoice_number: string;
+    amount_total: string;
+    status: string;
+    issued_at: string;
+    has_pdf: boolean;
+}
+
+/** GET /api/billing/transactions — пагинированная история транзакций. */
+export async function getTransactions(params: { page?: number; type?: string }): Promise<TransactionsPage> {
+    const { data } = await apiClient.get<TransactionsPage>('/api/billing/transactions', { params });
+    return data;
+}
+
+/** GET /api/billing/invoices — счета тенанта (real-but-empty до Б-1). */
+export async function getInvoices(): Promise<{ data: BillingInvoice[] }> {
+    const { data } = await apiClient.get<{ data: BillingInvoice[] }>('/api/billing/invoices');
+    return data;
+}
+
+/** Результат POST /api/billing/topup. */
+export interface TopupResult {
+    transaction: {
+        id: number;
+        type: string;
+        amount_rub: string;
+        balance_rub_after: string | null;
+        created_at: string;
+    };
+    balance_rub: string;
+}
+
+/** POST /api/billing/topup — пополнить рублёвый баланс (MVP-stub). */
+export async function topup(amountRub: number): Promise<TopupResult> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.post<TopupResult>('/api/billing/topup', { amount_rub: amountRub });
+    return data;
+}

app/resources/js/api/dashboard.ts

@@ -0,0 +1,26 @@
+import { apiClient } from './client';
+
+/**
+ * API-клиент дашборда (audit C1/J3). Эндпоинт GET /api/dashboard/summary.
+ * На MVP без auth — tenant_id параметром (на prod возьмётся из middleware).
+ */
+
+export type DeltaDir = 'up' | 'down' | 'neutral';
+export type DashboardRange = 'today' | '7d' | '30d';
+
+export interface DashboardSummary {
+    range: string;
+    leads_received: { value: number; delta_pct: number; delta_dir: DeltaDir };
+    conversion: { value: number; delta_pp: number; delta_dir: DeltaDir };
+    active_projects: { active: number; limit: number };
+    balance: { amount_rub: string; runway_days: number; runway_leads: number };
+    activity: { points: number[]; labels: string[]; max: number };
+    funnel: Record<string, number>;
+}
+
+export async function getDashboardSummary(tenantId: number, range: DashboardRange): Promise<DashboardSummary> {
+    const { data } = await apiClient.get<DashboardSummary>('/api/dashboard/summary', {
+        params: { tenant_id: tenantId, range },
+    });
+    return data;
+}

app/resources/js/api/deals.ts

@@ -233,3 +233,14 @@ export async function listProjects(tenantId: number): Promise<ApiProject[]> {
     });
     return data.projects;
 }
+
+/**
+ * Лёгкий count-only запрос для бейджа «Сделки» в AppSidebar (audit B2).
+ * Backend пропускает SELECT строк — отдаёт только COUNT(*).
+ */
+export async function fetchDealsCount(tenantId: number): Promise<number> {
+    const { data } = await apiClient.get<{ total: number }>('/api/deals', {
+        params: { tenant_id: tenantId, count_only: 1 },
+    });
+    return data.total;
+}

app/resources/js/api/imports.ts

@@ -0,0 +1,66 @@
+import { apiClient } from './client';
+
+/**
+ * API-клиент исторической миграции лидов (ТЗ §6).
+ * Эндпоинты: POST/GET /api/imports, /api/imports/unknown-statuses, /api/imports/unknown-statuses/resolve.
+ */
+
+export interface ImportLogResource {
+    id: number;
+    filename: string;
+    status: 'pending' | 'processing' | 'done' | 'failed';
+    rows_total: number;
+    rows_added: number;
+    rows_updated: number;
+    rows_skipped: number;
+    unknown_statuses_count: number;
+    dry_run: boolean;
+    error_message: string | null;
+    started_at: string | null;
+    finished_at: string | null;
+}
+
+export interface UnknownStatus {
+    id: number;
+    status_ru: string;
+    occurrences: number;
+}
+
+export interface StatusMapping {
+    status_ru: string;
+    slug: string;
+}
+
+/** POST /api/imports — загрузить CSV. */
+export async function uploadImport(file: File, dryRun = false): Promise<ImportLogResource> {
+    const form = new FormData();
+    form.append('file', file);
+    if (dryRun) {
+        form.append('dry_run', '1');
+    }
+    const { data } = await apiClient.post<{ data: ImportLogResource }>('/api/imports', form);
+    return data.data;
+}
+
+/** GET /api/imports — история импортов. */
+export async function listImports(): Promise<ImportLogResource[]> {
+    const { data } = await apiClient.get<{ data: ImportLogResource[] }>('/api/imports');
+    return data.data;
+}
+
+/** GET /api/imports/{id} — прогресс одного импорта. */
+export async function getImport(id: number): Promise<ImportLogResource> {
+    const { data } = await apiClient.get<{ data: ImportLogResource }>(`/api/imports/${id}`);
+    return data.data;
+}
+
+/** GET /api/imports/unknown-statuses — незамапленные статусы. */
+export async function getUnknownStatuses(): Promise<UnknownStatus[]> {
+    const { data } = await apiClient.get<{ data: UnknownStatus[] }>('/api/imports/unknown-statuses');
+    return data.data;
+}
+
+/** POST /api/imports/unknown-statuses/resolve — сохранить маппинг. */
+export async function resolveUnknownStatuses(mappings: StatusMapping[]): Promise<void> {
+    await apiClient.post('/api/imports/unknown-statuses/resolve', { mappings });
+}

app/resources/js/api/reports.ts

@@ -32,6 +32,7 @@ export interface ApiReportJob {
     parameters: ApiReportParameters;
     status: ApiReportStatus;
     file_path: string | null;
+    download_url: string | null;
     file_size: number | null;
     generation_seconds: number | null;
     error_message: string | null;

app/resources/js/api/webhooks.ts

@@ -0,0 +1,40 @@
+import { apiClient, ensureCsrfCookie } from './client';
+
+/**
+ * Настройки исходящего webhook'а тенанта (audit D4/D5). Backend:
+ * WebhookSettingsController. Полный secret доступен только в ответе
+ * saveWebhookSettings() при первом создании подписки.
+ */
+export interface WebhookSettings {
+    target_url: string;
+    secret_prefix: string;
+    events: string[];
+    is_active: boolean;
+}
+
+export interface SavedWebhookSettings extends WebhookSettings {
+    secret?: string;
+}
+
+export interface WebhookTestResult {
+    ok: boolean;
+    status: number | null;
+    message: string;
+}
+
+export async function getWebhookSettings(): Promise<WebhookSettings | null> {
+    const { data } = await apiClient.get<{ data: WebhookSettings | null }>('/api/tenants/me/webhook-settings');
+    return data.data;
+}
+
+export async function saveWebhookSettings(payload: { target_url: string }): Promise<SavedWebhookSettings> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.put<{ data: SavedWebhookSettings }>('/api/tenants/me/webhook-settings', payload);
+    return data.data;
+}
+
+export async function testWebhook(): Promise<WebhookTestResult> {
+    await ensureCsrfCookie();
+    const { data } = await apiClient.post<WebhookTestResult>('/api/webhooks/test');
+    return data;
+}

app/resources/js/components/AppShell.vue

@@ -2,7 +2,7 @@
 /**
  * Корневой shell приложения. Мапит meta.layout текущего route'а на layout-компонент.
  *
- * meta.layout = 'auth' → AuthLayout (двухпанельный для login/register/2fa/forgot/recovery).
+ * meta.layout = 'auth' → AuthLayout (двухпанельный для login/register/2fa/forgot/recovery-use).
  * meta.layout = 'error' → RouterView напрямую (ErrorView сам предоставляет v-app + теало-нуар bg).
  * meta.layout не задан или 'app' → AppLayout (sidebar + topbar для авторизованных страниц).
  *

app/resources/js/components/admin/ImpersonationBanner.vue

@@ -0,0 +1,84 @@
+<script setup lang="ts">
+/**
+ * Глобальный индикатор активных impersonation-сессий (audit B5 / Ю-1).
+ *
+ * Размещён в AdminLayout над <RouterView> — виден на всех /admin/* страницах.
+ * На MVP saas-admin auth нет и реального переключения сессии нет, поэтому
+ * показываем счётчик ВСЕХ активных сессий (impersonationActive() =
+ * used_at != null AND session_ended_at == null). Polling 30 c — сессия может
+ * стартовать/завершиться, пока админ остаётся в админке (AdminLayout
+ * persistent, перемонтируется только <RouterView>).
+ *
+ * Если активных сессий 0 — компонент не рендерит ничего.
+ */
+import { computed, onMounted, ref } from 'vue';
+import { impersonationActive, type ImpersonationActiveSession } from '../../api/admin';
+import { usePolling } from '../../composables/usePolling';
+
+const sessions = ref<ImpersonationActiveSession[]>([]);
+
+async function load(): Promise<void> {
+    try {
+        sessions.value = await impersonationActive();
+    } catch {
+        // Баннер не критичен — ошибку детально покажет AdminImpersonationView.
+        // Сохраняем прежнее значение sessions, не падаем.
+    }
+}
+
+const count = computed(() => sessions.value.length);
+
+const label = computed(() => {
+    if (count.value === 1) {
+        const s = sessions.value[0];
+        return `Активна impersonation-сессия: ${s.tenant_name ?? `тенант #${s.tenant_id}`}`;
+    }
+    return `Активны impersonation-сессии: ${count.value}`;
+});
+
+onMounted(load);
+usePolling(load, { intervalMs: 30_000 });
+
+defineExpose({ sessions, load });
+</script>
+
+<template>
+    <div v-if="count > 0" class="impersonation-banner" role="status" data-testid="impersonation-banner">
+        <v-icon size="16" class="impersonation-banner__icon">mdi-account-switch</v-icon>
+        <span class="impersonation-banner__label">{{ label }}</span>
+        <RouterLink
+            to="/admin/impersonation"
+            class="impersonation-banner__link"
+            data-testid="impersonation-banner-link"
+        >
+            Открыть
+        </RouterLink>
+    </div>
+</template>
+
+<style scoped>
+.impersonation-banner {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    background: #fff4e0;
+    border-bottom: 1px solid #f0d8a8;
+    color: #8a5a00;
+    font-size: 13px;
+    padding: 8px 24px;
+}
+.impersonation-banner__icon {
+    color: #b87400;
+}
+.impersonation-banner__label {
+    flex: 1;
+}
+.impersonation-banner__link {
+    color: #0f6e56;
+    font-weight: 600;
+    text-decoration: none;
+}
+.impersonation-banner__link:hover {
+    text-decoration: underline;
+}
+</style>

app/resources/js/components/billing/BalanceCard.vue

@@ -1,15 +1,27 @@
 <script setup lang="ts">
 /**
- * BalanceCard — 3 wallet-cards в одной строке: Кошелёк ₽ (primary, dark) +
- * Баланс лидов + Тариф. Sprint 4 Phase B/2 — split BillingView (audit O-refactor-04 хвост).
+ * BalanceCard — 3 wallet-cards в одной строке: Кошелёк ₽ (dark) +
+ * Баланс лидов + Тариф. Данные — из GET /api/billing/wallet (E3).
+ * tariff* допускают null (тенант без назначенного тарифа — trial).
  */
-defineProps<{
+import { computed } from 'vue';
+
+const props = defineProps<{
     walletRub: number;
     leadsBalance: number;
-    tariffName: string;
-    tariffPrice: number;
+    tariffName: string | null;
+    tariffPrice: string | null;
     tariffFeatures: string[];
 }>();
+
+defineEmits<{ topup: [] }>();
+
+const walletText = computed(() => new Intl.NumberFormat('ru-RU').format(props.walletRub));
+
+const tariffPriceText = computed(() => {
+    if (props.tariffPrice === null) return 'по запросу';
+    return new Intl.NumberFormat('ru-RU').format(Number(props.tariffPrice)) + ' ₽/мес';
+});
 </script>
 
 <template>
@@ -21,12 +33,19 @@ defineProps<{
                     <v-chip size="x-small" color="primary" variant="elevated">LIVE</v-chip>
                 </div>
                 <div class="wallet-amount mt-2">
-                    <span class="num">{{ new Intl.NumberFormat('ru-RU').format(walletRub) }}</span>
+                    <span class="num">{{ walletText }}</span>
                     <span class="ru">&nbsp;₽</span>
                 </div>
                 <div class="wallet-foot mt-3">мин. пополнение <strong>100 ₽</strong> · округление вниз ₽→лиды</div>
                 <div class="wallet-actions mt-3">
-                    <v-btn color="primary" variant="flat" prepend-icon="mdi-plus" size="small">Пополнить</v-btn>
+                    <v-btn
+                        color="primary"
+                        variant="flat"
+                        prepend-icon="mdi-plus"
+                        size="small"
+                        @click="$emit('topup')"
+                        >Пополнить</v-btn
+                    >
                     <v-btn variant="outlined" prepend-icon="mdi-autorenew" size="small"> Автопополнение </v-btn>
                 </div>
             </v-card>
@@ -41,22 +60,24 @@ defineProps<{
                     <span class="num">{{ leadsBalance }}</span>
                     <span class="ru-text">&nbsp;лидов</span>
                 </div>
-                <div class="wallet-foot mt-3">средняя цена <strong>50 ₽/лид</strong> · потрачено за месяц 412</div>
             </v-card>
         </v-col>
 
         <v-col cols="12" md="4">
             <v-card variant="outlined" class="wallet-card pa-4 d-flex flex-column">
                 <span class="wallet-label">Тариф</span>
-                <div class="tariff-name mt-1">
-                    {{ tariffName }}
-                    <span class="tariff-price">· {{ tariffPrice }} ₽/мес</span>
-                </div>
-                <ul class="tariff-feats mt-3">
-                    <li v-for="f in tariffFeatures" :key="f">
-                        <v-icon size="14" color="success" class="mr-1">mdi-check</v-icon>{{ f }}
-                    </li>
-                </ul>
+                <template v-if="tariffName">
+                    <div class="tariff-name mt-1">
+                        {{ tariffName }}
+                        <span class="tariff-price">· {{ tariffPriceText }}</span>
+                    </div>
+                    <ul v-if="tariffFeatures.length" class="tariff-feats mt-3">
+                        <li v-for="f in tariffFeatures" :key="f">
+                            <v-icon size="14" color="success" class="mr-1">mdi-check</v-icon>{{ f }}
+                        </li>
+                    </ul>
+                </template>
+                <div v-else class="tariff-empty mt-2">Тариф не выбран</div>
                 <v-btn variant="outlined" size="small" class="mt-auto">Сменить тариф →</v-btn>
             </v-card>
         </v-col>
@@ -137,6 +158,10 @@ defineProps<{
     font-weight: 500;
     margin-left: 4px;
 }
+.tariff-empty {
+    color: #66635c;
+    font-size: 14px;
+}
 .tariff-feats {
     list-style: none;
     padding: 0;

app/resources/js/components/billing/InvoicesTable.vue

@@ -1,29 +1,84 @@
 <script setup lang="ts">
 /**
- * InvoicesTable — список счетов и УПД (PDF / 1С 8.3 XML).
- * Sprint 4 Phase B/2 — split BillingView.
+ * InvoicesTable — список счетов тенанта. Данные — GET /api/billing/invoices
+ * (E3). Real-but-empty до Б-1: на MVP saas_invoices пуста (нужно
+ * зарегистрированное юр-лицо), компонент показывает empty-state.
  */
-import { MOCK_INVOICES } from '../../composables/mockBilling';
-import { formatIcon, formatLabel, formatPlain } from '../../composables/billingFormatters';
+import { ref, onMounted } from 'vue';
+import { getInvoices, type BillingInvoice } from '../../api/billing';
+import { formatPlain } from '../../composables/billingFormatters';
+
+const invoices = ref<BillingInvoice[]>([]);
+const loading = ref(true);
+const loadError = ref<string | null>(null);
+
+const STATUS_LABELS: Record<string, string> = {
+    draft: 'Черновик',
+    issued: 'Выставлен',
+    paid: 'Оплачен',
+    overdue: 'Просрочен',
+    cancelled: 'Отменён',
+};
+
+function statusLabel(status: string): string {
+    return STATUS_LABELS[status] ?? status;
+}
+
+function formatDate(iso: string): string {
+    return new Date(iso).toLocaleDateString('ru-RU', { timeZone: 'Europe/Moscow' });
+}
+
+async function load(): Promise<void> {
+    loading.value = true;
+    loadError.value = null;
+    try {
+        invoices.value = (await getInvoices()).data;
+    } catch {
+        loadError.value = 'Не удалось загрузить счета.';
+    } finally {
+        loading.value = false;
+    }
+}
+
+onMounted(load);
+
+defineExpose({ load, invoices });
 </script>
 
 <template>
     <v-card variant="outlined" class="mt-4 panel">
         <div class="panel-h pa-4">
-            <h2 class="text-h6 panel-title ma-0">Счета и УПД</h2>
-            <v-btn variant="outlined" size="small" prepend-icon="mdi-download">Реестр XLSX</v-btn>
+            <h2 class="text-h6 panel-title ma-0">Счета</h2>
         </div>
         <v-divider />
-        <ul class="invoices-list pa-2 ma-0">
-            <li v-for="inv in MOCK_INVOICES" :key="inv.id" class="inv-row">
-                <span class="inv-when num">{{ inv.when }}</span>
+
+        <div v-if="loading" class="py-8 d-flex justify-center">
+            <v-progress-circular indeterminate color="primary" size="28" />
+        </div>
+
+        <v-alert v-else-if="loadError" type="error" variant="tonal" density="compact" class="ma-4" role="alert">
+            {{ loadError }}
+        </v-alert>
+
+        <div v-else-if="invoices.length === 0" class="empty pa-8 text-center text-medium-emphasis">
+            Счета появятся после первой оплаты.
+        </div>
+
+        <ul v-else class="invoices-list pa-2 ma-0">
+            <li v-for="inv in invoices" :key="inv.id" class="inv-row">
+                <span class="inv-when num">{{ formatDate(inv.issued_at) }}</span>
                 <span class="inv-name">
-                    {{ inv.title }}
-                    <span class="sub">{{ inv.sub }}</span>
+                    {{ inv.invoice_number }}
+                    <span class="sub">{{ statusLabel(inv.status) }}</span>
                 </span>
-                <span class="inv-amount num">{{ formatPlain(inv.amountRub) }}</span>
-                <v-btn variant="text" size="small" :prepend-icon="formatIcon(inv.format)">
-                    {{ formatLabel(inv.format) }}
+                <span class="inv-amount num">{{ formatPlain(Number(inv.amount_total)) }}</span>
+                <v-btn
+                    variant="text"
+                    size="small"
+                    prepend-icon="mdi-file-pdf-box"
+                    :disabled="!inv.has_pdf"
+                >
+                    PDF
                 </v-btn>
             </li>
         </ul>
@@ -52,6 +107,10 @@ import { formatIcon, formatLabel, formatPlain } from '../../composables/billingF
     letter-spacing: -0.01em;
 }
 
+.empty {
+    font-size: 14px;
+}
+
 .invoices-list {
     list-style: none;
     padding: 0;

app/resources/js/components/billing/TopupDialog.vue

@@ -0,0 +1,125 @@
+<script setup lang="ts">
+/**
+ * TopupDialog — диалог пополнения рублёвого баланса (audit E1).
+ *
+ * MVP-stub: POST /api/billing/topup кредитует баланс немедленно (без
+ * платёжного шлюза — реальная оплата post-Б-1). При успехе эмитит
+ * `success` с новым балансом и закрывается.
+ */
+import { ref, computed, watch } from 'vue';
+import { topup } from '../../api/billing';
+import { extractErrorMessage, extractValidationErrors } from '../../api/client';
+
+const model = defineModel<boolean>({ required: true });
+const emit = defineEmits<{ success: [balanceRub: string] }>();
+
+const PRESETS = [1000, 5000, 10000, 25000];
+
+const amount = ref<number | null>(null);
+const submitting = ref(false);
+const errorMsg = ref<string | null>(null);
+
+const amountError = computed<string | null>(() => {
+    if (amount.value === null || !Number.isFinite(amount.value)) return null;
+    if (amount.value < 100) return 'Минимум 100 ₽';
+    if (amount.value > 1000000) return 'Максимум 1 000 000 ₽';
+    return null;
+});
+
+const canSubmit = computed(
+    () => Number.isFinite(amount.value) && amountError.value === null && !submitting.value,
+);
+
+// Сброс состояния при каждом открытии диалога (паттерн ReminderDialog/
+// NewDealDialog) — нет префилла прошлой суммы и нет всплытия устаревшей ошибки.
+watch(model, (open) => {
+    if (open) {
+        amount.value = null;
+        errorMsg.value = null;
+    }
+});
+
+function setPreset(value: number): void {
+    amount.value = value;
+}
+
+async function submit(): Promise<void> {
+    if (!canSubmit.value || amount.value === null) return;
+    submitting.value = true;
+    errorMsg.value = null;
+    try {
+        const res = await topup(amount.value);
+        emit('success', res.balance_rub);
+        model.value = false;
+        amount.value = null;
+    } catch (e) {
+        const validation = extractValidationErrors(e);
+        errorMsg.value = validation?.amount_rub?.[0] ?? extractErrorMessage(e);
+    } finally {
+        submitting.value = false;
+    }
+}
+
+function close(): void {
+    if (submitting.value) return;
+    model.value = false;
+    errorMsg.value = null;
+}
+
+defineExpose({ amount, submit, canSubmit, errorMsg });
+</script>
+
+<template>
+    <v-dialog v-model="model" max-width="460">
+        <v-card>
+            <v-card-title class="text-h6">Пополнить баланс</v-card-title>
+            <v-card-text>
+                <v-text-field
+                    v-model.number="amount"
+                    type="number"
+                    label="Сумма пополнения"
+                    suffix="₽"
+                    density="comfortable"
+                    :error-messages="amountError ?? undefined"
+                    autofocus
+                />
+
+                <div class="presets mb-2">
+                    <v-chip
+                        v-for="p in PRESETS"
+                        :key="p"
+                        size="small"
+                        variant="outlined"
+                        @click="setPreset(p)"
+                    >
+                        {{ new Intl.NumberFormat('ru-RU').format(p) }} ₽
+                    </v-chip>
+                </div>
+
+                <v-alert type="info" variant="tonal" density="compact" class="mt-2">
+                    Платёжный шлюз подключается после регистрации юр. лица — на текущем этапе баланс
+                    пополняется сразу.
+                </v-alert>
+
+                <v-alert v-if="errorMsg" type="error" variant="tonal" density="compact" class="mt-3" role="alert">
+                    {{ errorMsg }}
+                </v-alert>
+            </v-card-text>
+            <v-card-actions>
+                <v-spacer />
+                <v-btn variant="text" :disabled="submitting" @click="close">Отмена</v-btn>
+                <v-btn color="primary" variant="flat" :loading="submitting" :disabled="!canSubmit" @click="submit">
+                    Пополнить
+                </v-btn>
+            </v-card-actions>
+        </v-card>
+    </v-dialog>
+</template>
+
+<style scoped>
+.presets {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 8px;
+}
+</style>

app/resources/js/components/billing/TransactionsTable.vue

@@ -1,63 +1,155 @@
 <script setup lang="ts">
 /**
- * TransactionsTable — VDataTable истории транзакций с табами фильтрации
- * (Все / Пополнения / Списания / Возвраты). Sprint 4 Phase B/2 — split BillingView.
+ * TransactionsTable — server-driven история транзакций с табами
+ * (Все / Пополнения / Списания / Возвраты). Данные — GET
+ * /api/billing/transactions (E3). Паттерн self-fetching из ChargesTab.
  */
-import { computed, ref } from 'vue';
-import { BILLING_TABS, MOCK_TRANSACTIONS, type BillingTransaction } from '../../composables/mockBilling';
-import { formatCost, statusChipColor, statusLabel, txAmountClass } from '../../composables/billingFormatters';
+import { ref, onMounted } from 'vue';
+import { getTransactions, type BillingTransaction } from '../../api/billing';
+import { formatCost, txAmountClass } from '../../composables/billingFormatters';
 
-const activeTab = ref<(typeof BILLING_TABS)[number]['id']>('all');
+interface Tab {
+    id: string;
+    label: string;
+    type: string | null;
+}
 
-const filteredTransactions = computed<BillingTransaction[]>(() => {
-    const tab = BILLING_TABS.find((t) => t.id === activeTab.value);
-    const types = tab?.types;
-    if (!types) return MOCK_TRANSACTIONS;
-    return MOCK_TRANSACTIONS.filter((tx) => types.includes(tx.type));
-});
+const TABS: Tab[] = [
+    { id: 'all', label: 'Все', type: null },
+    { id: 'topup', label: 'Пополнения', type: 'topup' },
+    { id: 'lead_charge', label: 'Списания', type: 'lead_charge' },
+    { id: 'refund', label: 'Возвраты', type: 'refund' },
+];
+
+const activeTab = ref<string>('all');
+const rows = ref<BillingTransaction[]>([]);
+const total = ref(0);
+const loading = ref(false);
+const loadError = ref<string | null>(null);
+const page = ref(1);
+
+const headers = [
+    { title: 'Дата', key: 'created_at', sortable: false },
+    { title: 'Операция', key: 'description', sortable: false },
+    { title: 'ID', key: 'code', sortable: false, width: 120 },
+    { title: 'Сумма', key: 'amount_rub', align: 'end' as const, sortable: false, width: 140 },
+];
+
+function formatWhen(iso: string): string {
+    return new Date(iso).toLocaleString('ru-RU', {
+        timeZone: 'Europe/Moscow',
+        day: '2-digit',
+        month: '2-digit',
+        hour: '2-digit',
+        minute: '2-digit',
+    });
+}
+
+/** Числовое значение движения: рубли приоритетно, иначе лиды. */
+function txAmountValue(tx: BillingTransaction): number {
+    const rub = Number(tx.amount_rub);
+    return rub !== 0 ? rub : tx.amount_leads;
+}
+
+/** Текст суммы: «+ 5 000 ₽» / «− 1 лид.» / «0 ₽». */
+function txAmountText(tx: BillingTransaction): string {
+    const rub = Number(tx.amount_rub);
+    if (rub !== 0) return formatCost(rub);
+    if (tx.amount_leads !== 0) {
+        const sign = tx.amount_leads > 0 ? '+ ' : '− ';
+        return sign + Math.abs(tx.amount_leads) + ' лид.';
+    }
+    return '0 ₽';
+}
+
+async function load(): Promise<void> {
+    loading.value = true;
+    loadError.value = null;
+    try {
+        const tab = TABS.find((t) => t.id === activeTab.value);
+        const params: { page: number; type?: string } = { page: page.value };
+        if (tab?.type) params.type = tab.type;
+        const res = await getTransactions(params);
+        rows.value = res.data;
+        total.value = res.meta.total;
+    } catch {
+        loadError.value = 'Не удалось загрузить транзакции.';
+        rows.value = [];
+        total.value = 0;
+    } finally {
+        loading.value = false;
+    }
+}
+
+async function changeTab(id: string): Promise<void> {
+    activeTab.value = id;
+    page.value = 1;
+    await load();
+}
+
+async function loadOptions(opts: { page: number }): Promise<void> {
+    page.value = opts.page;
+    await load();
+}
+
+async function refresh(): Promise<void> {
+    page.value = 1;
+    await load();
+}
+
+onMounted(load);
+
+defineExpose({ load, refresh, changeTab, activeTab, total, rows });
 </script>
 
 <template>
     <v-card variant="outlined" class="mt-4 panel">
         <div class="panel-h pa-4">
             <h2 class="text-h6 panel-title ma-0">История транзакций</h2>
-            <v-btn-toggle v-model="activeTab" mandatory color="primary" density="comfortable" variant="text">
-                <v-btn v-for="tab in BILLING_TABS" :key="tab.id" :value="tab.id" size="small">
+            <v-btn-toggle
+                :model-value="activeTab"
+                mandatory
+                color="primary"
+                density="comfortable"
+                variant="text"
+            >
+                <v-btn
+                    v-for="tab in TABS"
+                    :key="tab.id"
+                    :value="tab.id"
+                    size="small"
+                    @click="changeTab(tab.id)"
+                >
                     {{ tab.label }}
                 </v-btn>
             </v-btn-toggle>
         </div>
 
-        <v-data-table
-            :items="filteredTransactions"
-            :headers="[
-                { title: 'Дата', key: 'when', sortable: false },
-                { title: 'Операция', key: 'description', sortable: false },
-                { title: 'ID', key: 'code', sortable: false },
-                { title: 'Статус', key: 'status', sortable: false },
-                { title: 'Сумма', key: 'amount', align: 'end', sortable: false },
-            ]"
-            items-per-page="-1"
-            hide-default-footer
+        <v-alert v-if="loadError" type="error" variant="tonal" density="compact" class="mx-4 mb-4" role="alert">
+            {{ loadError }}
+        </v-alert>
+
+        <v-data-table-server
+            :headers="headers"
+            :items="rows"
+            :items-length="total"
+            :loading="loading"
+            :items-per-page="20"
             density="comfortable"
+            @update:options="loadOptions"
         >
-            <template #[`item.when`]="{ item }">
-                <span class="tx-when num">{{ item.when }}</span>
+            <template #[`item.created_at`]="{ item }">
+                <span class="tx-when num">{{ formatWhen(item.created_at) }}</span>
             </template>
             <template #[`item.code`]="{ item }">
                 <span class="tx-id">#{{ item.code }}</span>
             </template>
-            <template #[`item.status`]="{ item }">
-                <v-chip size="small" variant="tonal" :color="statusChipColor(item.status)">
-                    {{ statusLabel(item.status) }}
-                </v-chip>
-            </template>
-            <template #[`item.amount`]="{ item }">
-                <span class="num" :class="txAmountClass(item)">
-                    {{ item.status === 'rejected' ? '— 0 ₽' : formatCost(item.amount) }}
+            <template #[`item.amount_rub`]="{ item }">
+                <span class="num" :class="txAmountClass(txAmountValue(item))">
+                    {{ txAmountText(item) }}
                 </span>
             </template>
-        </v-data-table>
+        </v-data-table-server>
     </v-card>
 </template>
 

app/resources/js/components/deals/NewDealDialog.vue

@@ -42,7 +42,8 @@ async function loadLookups(tenantId: number) {
             managerIdByName.value = map;
         }
     } catch {
-        // Молчаливый fallback на mock — UI пользователь всё равно увидит.
+        // Audit C6: фиксируем провал — UI покажет degradation-alert.
+        lookupsFailed.value = true;
     }
 }
 
@@ -76,6 +77,9 @@ const errors = ref<Record<string, string>>({});
 const submitError = ref<string | null>(null);
 const busy = ref(false);
 
+// Audit C6: loadLookups упал → показываем degradation-alert (списки = mock).
+const lookupsFailed = ref(false);
+
 // Регенерируем ID на каждое создание для local-mode. На API — backend SERIAL.
 function nextId(): number {
     return Math.floor(Date.now() / 1000) + Math.floor(Math.random() * 1000);
@@ -91,6 +95,7 @@ function reset() {
     errors.value = {};
     submitError.value = null;
     busy.value = false;
+    lookupsFailed.value = false;
 }
 
 watch(
@@ -170,6 +175,8 @@ async function submit() {
     }
 }
 
+defineExpose({ lookupsFailed });
+
 function close() {
     dialogOpen.value = false;
 }
@@ -190,6 +197,17 @@ function close() {
                 >
                     {{ submitError }}
                 </v-alert>
+                <v-alert
+                    v-if="lookupsFailed"
+                    type="warning"
+                    variant="tonal"
+                    density="compact"
+                    class="mb-3"
+                    data-testid="lookups-error-alert"
+                >
+                    Не удалось загрузить списки проектов и менеджеров — показаны примерные значения. Проверьте выбор
+                    перед сохранением.
+                </v-alert>
                 <v-row dense>
                     <v-col cols="12" md="6">
                         <v-text-field

app/resources/js/components/import/UnknownStatusesDialog.vue

@@ -0,0 +1,125 @@
+<script setup lang="ts">
+/**
+ * Wizard маппинга неизвестных статусов воронки из CSV-импорта (ТЗ §6.4/§6.6).
+ *
+ * Для каждого незамапленного русского статуса пользователь выбирает один из
+ * 14 канонических slug'ов. Сохранение → POST /api/imports/unknown-statuses/resolve.
+ */
+import { computed, reactive, ref } from 'vue';
+import { resolveUnknownStatuses, type StatusMapping, type UnknownStatus } from '../../api/imports';
+
+const props = defineProps<{
+    modelValue: boolean;
+    statuses: UnknownStatus[];
+}>();
+
+const emit = defineEmits<{
+    'update:modelValue': [value: boolean];
+    resolved: [];
+}>();
+
+/** 14 канонических статусов воронки (ТЗ §6.4). */
+const STATUS_OPTIONS: { value: string; title: string }[] = [
+    { value: 'new', title: 'Новые' },
+    { value: 'viewed', title: 'Просмотрено' },
+    { value: 'worked', title: 'Проработан' },
+    { value: 'base', title: 'База' },
+    { value: 'missed', title: 'Недозвон' },
+    { value: 'negotiations', title: 'Переговоры' },
+    { value: 'waiting_payment', title: 'Ожидаем оплаты' },
+    { value: 'partnership', title: 'Партнерка' },
+    { value: 'paid', title: 'Оплачено' },
+    { value: 'closed', title: 'Закрыто и не реализовано' },
+    { value: 'test_drive', title: 'Тест драйв' },
+    { value: 'hot', title: 'Горячий' },
+    { value: 'replacement', title: 'На замену' },
+    { value: 'final_missed', title: 'Конечный недозвон' },
+];
+
+const selection = reactive<Record<string, string | null>>({});
+const saving = ref(false);
+const error = ref<string | null>(null);
+
+const dialogOpen = computed({
+    get: () => props.modelValue,
+    set: (v: boolean) => emit('update:modelValue', v),
+});
+
+const allMapped = computed(
+    () => props.statuses.length > 0 && props.statuses.every((s) => !!selection[s.status_ru]),
+);
+
+async function save(): Promise<void> {
+    if (!allMapped.value) {
+        return;
+    }
+    saving.value = true;
+    error.value = null;
+    try {
+        const mappings: StatusMapping[] = props.statuses.map((s) => ({
+            status_ru: s.status_ru,
+            slug: selection[s.status_ru] as string,
+        }));
+        await resolveUnknownStatuses(mappings);
+        emit('resolved');
+    } catch {
+        error.value = 'Не удалось сохранить маппинг. Повторите попытку.';
+    } finally {
+        saving.value = false;
+    }
+}
+
+defineExpose({ selection, save });
+</script>
+
+<template>
+    <v-dialog v-model="dialogOpen" max-width="640">
+        <v-card>
+            <v-card-title class="text-h6">Маппинг неизвестных статусов</v-card-title>
+            <v-card-text>
+                <p class="text-body-2 text-medium-emphasis mb-4">
+                    Эти статусы из CSV не входят в стандартную воронку. Выберите
+                    соответствие — повторный импорт применит маппинг автоматически.
+                </p>
+                <div
+                    v-for="status in statuses"
+                    :key="status.id"
+                    class="d-flex align-center ga-3 mb-3"
+                >
+                    <div class="flex-grow-1">
+                        <strong>{{ status.status_ru }}</strong>
+                        <span class="text-caption text-medium-emphasis ml-2">
+                            ({{ status.occurrences }} шт.)
+                        </span>
+                    </div>
+                    <v-select
+                        v-model="selection[status.status_ru]"
+                        :items="STATUS_OPTIONS"
+                        label="Статус воронки"
+                        density="compact"
+                        variant="outlined"
+                        hide-details
+                        style="max-width: 280px"
+                    />
+                </div>
+                <v-alert v-if="error" type="error" variant="tonal" class="mt-2">
+                    {{ error }}
+                </v-alert>
+            </v-card-text>
+            <v-card-actions>
+                <v-spacer />
+                <v-btn variant="text" @click="dialogOpen = false">Отмена</v-btn>
+                <v-btn
+                    data-test="save-mappings"
+                    color="primary"
+                    variant="flat"
+                    :loading="saving"
+                    :disabled="!allMapped"
+                    @click="save"
+                >
+                    Сохранить
+                </v-btn>
+            </v-card-actions>
+        </v-card>
+    </v-dialog>
+</template>

app/resources/js/components/layout/AppSidebar.vue

@@ -5,11 +5,14 @@
  *   + active-marker pseudo-element + JetBrains Mono badges.
  *
  * Brand mark + nav-tree (3 группы: Работа, Финансы, Команда).
- * Counts для «Сделки» — mock.
+ * Count для «Сделки» — live из API (dealsCount-store, audit B2).
  */
-import { computed } from 'vue';
+import { computed, onMounted } from 'vue';
 import { useRoute } from 'vue-router';
 import Kbd from '../ui/Kbd.vue';
+import { useAuthStore } from '../../stores/auth';
+import { useDealsCountStore } from '../../stores/dealsCount';
+import { useCommandPalette } from '../../composables/useCommandPalette';
 
 interface NavItem {
     title: string;
@@ -26,15 +29,31 @@ interface NavGroup {
 const drawerOpen = defineModel<boolean>('drawerOpen', { default: true });
 
 const route = useRoute();
+const auth = useAuthStore();
+const dealsCount = useDealsCountStore();
+const { openPalette } = useCommandPalette();
+
+onMounted(() => {
+    if (auth.user?.tenant_id) void dealsCount.load(auth.user.tenant_id);
+});
 
 const navGroups = computed<NavGroup[]>(() => [
     {
         eyebrow: 'Работа',
         items: [
             { title: 'Проекты', icon: 'mdi-folder-multiple-outline', to: '/projects' },
-            { title: 'Сделки', icon: 'mdi-format-list-bulleted', to: '/deals', count: 247 },
+            // B2: count из dealsCount-store; null → undefined (NavItem.count — number|undefined),
+            // resolveCount затем → 0 и v-if скрывает бейдж пока счётчик не загружен.
+            {
+                title: 'Сделки',
+                icon: 'mdi-format-list-bulleted',
+                to: '/deals',
+                count: dealsCount.count ?? undefined,
+                countKey: 'deals',
+            },
             { title: 'Канбан', icon: 'mdi-view-column-outline', to: '/kanban' },
             { title: 'Дашборд', icon: 'mdi-view-dashboard-outline', to: '/dashboard' },
+            { title: 'Импорт данных', icon: 'mdi-database-import-outline', to: '/import' },
         ],
     },
     {
@@ -63,7 +82,15 @@ defineExpose({ navGroups });
             <span class="ld-sidebar__brand-name">Лидерра<span class="ld-sidebar__brand-dot">.</span></span>
         </div>
 
-        <div class="ld-cmdk-stub" role="button" tabindex="0">
+        <div
+            class="ld-cmdk-stub"
+            role="button"
+            tabindex="0"
+            data-testid="cmdk-stub"
+            @click="openPalette"
+            @keydown.enter="openPalette"
+            @keydown.space.prevent="openPalette"
+        >
             <span class="ld-cmdk-stub__placeholder">Поиск, команды…</span>
             <Kbd dark>⌘K</Kbd>
         </div>

app/resources/js/components/layout/AppTopbar.vue

@@ -8,6 +8,7 @@ import { computed } from 'vue';
 import { useRouter } from 'vue-router';
 import { useAuthStore } from '../../stores/auth';
 import { useNotificationsStore } from '../../stores/notifications';
+import { useCommandPalette } from '../../composables/useCommandPalette';
 
 defineProps<{
     pageTitle: string;
@@ -20,6 +21,7 @@ const emit = defineEmits<{
 const auth = useAuthStore();
 const notifications = useNotificationsStore();
 const router = useRouter();
+const { openPalette } = useCommandPalette();
 
 const unreadDisplay = computed(() => {
     if (notifications.unreadCount === 0) return '';
@@ -56,8 +58,8 @@ function formatRelative(iso: string | null): string {
 async function handleNotificationClick(id: number, dealId: number | null): Promise<void> {
     await notifications.markRead(id);
     if (dealId !== null) {
-        // На MVP — push на DealsView (deep-link на конкретный drawer — отдельный коммит).
-        await router.push('/deals');
+        // Audit F3: deep-link на конкретный drawer через ?openId=.
+        await router.push({ path: '/deals', query: { openId: dealId } });
     }
 }
 
@@ -87,11 +89,7 @@ async function handleLogout(): Promise<void> {
 
 <template>
     <v-app-bar :elevation="0" color="surface" class="app-topbar" :height="56">
-        <v-app-bar-nav-icon
-            class="d-md-none"
-            aria-label="Открыть меню навигации"
-            @click="emit('toggle-drawer')"
-        />
+        <v-app-bar-nav-icon class="d-md-none" aria-label="Открыть меню навигации" @click="emit('toggle-drawer')" />
 
         <div class="crumb">
             <strong>{{ pageTitle }}</strong>
@@ -99,7 +97,14 @@ async function handleLogout(): Promise<void> {
 
         <v-spacer />
 
-        <v-btn variant="outlined" size="small" prepend-icon="mdi-magnify" class="searchbar mr-2" disabled>
+        <v-btn
+            variant="outlined"
+            size="small"
+            prepend-icon="mdi-magnify"
+            class="searchbar mr-2"
+            data-testid="topbar-search-btn"
+            @click="openPalette"
+        >
             Поиск
             <template #append>
                 <kbd class="search-kbd">⌘K</kbd>

app/resources/js/components/layout/CommandPalette.vue

@@ -0,0 +1,113 @@
+<script setup lang="ts">
+/**
+ * Минимальная command-palette (audit B3). Открывается по ⌘K / Ctrl+K, кликом
+ * на плашку в AppSidebar или кнопку «Поиск» в AppTopbar. Список — навигация
+ * по 8 разделам портала; фильтр по подстроке; Enter → первый результат.
+ * Монтируется один раз в AppLayout.
+ */
+import { computed, onMounted, onUnmounted, ref, watch } from 'vue';
+import { useRouter } from 'vue-router';
+import { useCommandPalette } from '../../composables/useCommandPalette';
+
+interface PaletteItem {
+    title: string;
+    icon: string;
+    to: string;
+}
+
+const NAV_ITEMS: PaletteItem[] = [
+    { title: 'Проекты', icon: 'mdi-folder-multiple-outline', to: '/projects' },
+    { title: 'Сделки', icon: 'mdi-format-list-bulleted', to: '/deals' },
+    { title: 'Канбан', icon: 'mdi-view-column-outline', to: '/kanban' },
+    { title: 'Дашборд', icon: 'mdi-view-dashboard-outline', to: '/dashboard' },
+    { title: 'Импорт данных', icon: 'mdi-database-import-outline', to: '/import' },
+    { title: 'Биллинг', icon: 'mdi-credit-card-outline', to: '/billing' },
+    { title: 'Отчёты', icon: 'mdi-chart-box-outline', to: '/reports' },
+    { title: 'Настройки', icon: 'mdi-cog-outline', to: '/settings' },
+];
+
+const { open, closePalette } = useCommandPalette();
+const router = useRouter();
+
+const query = ref('');
+
+const filteredItems = computed<PaletteItem[]>(() => {
+    const q = query.value.trim().toLowerCase();
+    if (q === '') return NAV_ITEMS;
+    return NAV_ITEMS.filter((i) => i.title.toLowerCase().includes(q));
+});
+
+// Сброс query при каждом открытии.
+watch(open, (isOpen) => {
+    if (isOpen) query.value = '';
+});
+
+function selectItem(item: PaletteItem): void {
+    closePalette();
+    void router.push(item.to);
+}
+
+function onSubmit(): void {
+    const first = filteredItems.value[0];
+    if (first) selectItem(first);
+}
+
+function onGlobalKeydown(e: KeyboardEvent): void {
+    if ((e.metaKey || e.ctrlKey) && e.key.toLowerCase() === 'k') {
+        if (open.value) return;
+        e.preventDefault();
+        open.value = true;
+    }
+}
+
+onMounted(() => window.addEventListener('keydown', onGlobalKeydown));
+onUnmounted(() => window.removeEventListener('keydown', onGlobalKeydown));
+
+defineExpose({ query, filteredItems, selectItem, onSubmit });
+</script>
+
+<template>
+    <v-dialog v-model="open" :max-width="520" data-testid="command-palette">
+        <v-card class="cmdk-card">
+            <v-text-field
+                v-model="query"
+                autofocus
+                placeholder="Поиск разделов…"
+                variant="plain"
+                density="comfortable"
+                hide-details
+                prepend-inner-icon="mdi-magnify"
+                class="cmdk-input px-3 pt-2"
+                data-testid="command-palette-input"
+                @keydown.enter="onSubmit"
+            />
+            <v-divider />
+            <v-list density="compact" class="cmdk-list" data-testid="command-palette-list">
+                <v-list-item
+                    v-for="item in filteredItems"
+                    :key="item.to"
+                    :prepend-icon="item.icon"
+                    :title="item.title"
+                    data-testid="command-palette-item"
+                    @click="selectItem(item)"
+                />
+                <v-list-item
+                    v-if="filteredItems.length === 0"
+                    class="text-medium-emphasis"
+                    title="Ничего не найдено"
+                    data-testid="command-palette-empty"
+                />
+            </v-list>
+        </v-card>
+    </v-dialog>
+</template>
+
+<style scoped>
+.cmdk-card {
+    overflow: hidden;
+}
+.cmdk-list {
+    max-height: 320px;
+    overflow-y: auto;
+}
+</style>

app/resources/js/components/projects/BulkActionsBar.vue

@@ -55,6 +55,19 @@
             :count="store.selectedIds.size"
             @apply="(p) => runBulk({ action: 'update_limit', ...p })"
         />
+
+        <v-snackbar
+            v-model="skipToastOpen"
+            :timeout="6000"
+            color="warning"
+            location="bottom right"
+            data-testid="bulk-skip-toast"
+        >
+            {{ skipToastText }}
+            <template #actions>
+                <v-btn variant="text" @click="skipToastOpen = false">Закрыть</v-btn>
+            </template>
+        </v-snackbar>
     </v-card>
 </template>
 
@@ -72,6 +85,10 @@ const regionsOpen = ref(false);
 const daysOpen = ref(false);
 const limitOpen = ref(false);
 
+// Sprint 1 C5: window.alert → v-snackbar (non-blocking, accessible, не breaks браузерный automation).
+const skipToastOpen = ref(false);
+const skipToastText = ref('');
+
 const messages: Record<string, string> = {
     pause: 'Приостановить выбранные проекты?',
     resume: 'Возобновить выбранные проекты?',
@@ -87,13 +104,12 @@ async function confirmAndRun(action: 'pause' | 'resume' | 'archive') {
 async function runBulk(payload: Parameters<typeof store.bulkUpdate>[0]) {
     const result = await store.bulkUpdate(payload);
     if (result.skipped.length > 0) {
-        window.alert(
-            `Применено: ${result.updated}. Пропущено: ${result.skipped.length} (конфликт с уже доставленными лидами).`,
-        );
+        skipToastText.value = `Применено: ${result.updated}. Пропущено: ${result.skipped.length} (конфликт с уже доставленными лидами).`;
+        skipToastOpen.value = true;
     }
 }
 
-defineExpose({ regionsOpen, daysOpen, limitOpen });
+defineExpose({ regionsOpen, daysOpen, limitOpen, skipToastOpen, skipToastText, runBulk });
 </script>
 
 <style scoped>

app/resources/js/components/reports/ReportJobsList.vue

@@ -98,7 +98,8 @@ function canRetry(job: ReportJob): boolean {
                 </v-chip>
                 <div class="job-actions">
                     <v-btn
-                        v-if="job.status === 'done'"
+                        v-if="job.status === 'done' && job.downloadUrl"
+                        :href="job.downloadUrl"
                         icon="mdi-download"
                         variant="text"
                         size="small"

app/resources/js/composables/billingFormatters.ts

@@ -1,9 +1,11 @@
 /**
- * Форматтеры для биллинга. Экспортируются для использования в нескольких
- * sub-components BillingView (BalanceCard, TransactionsTable, InvoicesTable).
- * Sprint 4 Phase B/2 — split BillingView.
+ * Форматтеры биллинга — BillingView + TransactionsTable + InvoicesTable.
+ *
+ * Sprint 2 Plan C: status/format-функции (statusChipColor/statusLabel/
+ * formatLabel/formatIcon) удалены — real-API транзакции не имеют статуса
+ * (append-only ledger), счета — отдельный формат. txAmountClass
+ * перетипизирован под знак суммы.
  */
-import type { BillingTransaction, InvoiceFormat, TxStatus } from './mockBilling';
 
 /** «5000» → «5 000 ₽» (без знака). */
 export function formatPlain(cost: number): string {
@@ -16,36 +18,25 @@ export function formatCost(cost: number): string {
     return sign + new Intl.NumberFormat('ru-RU').format(Math.abs(cost)) + ' ₽';
 }
 
-/** CSS-класс для суммы транзакции по статусу/знаку. */
-export function txAmountClass(tx: BillingTransaction): string {
-    if (tx.status === 'rejected') return 'tx-amount-neutral';
-    if (tx.amount > 0) return 'tx-amount-up';
-    if (tx.amount < 0) return 'tx-amount-down';
+/** CSS-класс суммы транзакции по знаку. */
+export function txAmountClass(amount: number): string {
+    if (amount > 0) return 'tx-amount-up';
+    if (amount < 0) return 'tx-amount-down';
     return 'tx-amount-neutral';
 }
 
-/** Vuetify-цвет чипа статуса транзакции. */
-export function statusChipColor(status: TxStatus): string {
-    if (status === 'pending') return 'warning';
-    if (status === 'completed') return 'success';
-    return 'error';
-}
+/** Человекочитаемые лейблы для feature-слагов tariff_plans.features. */
+export const FEATURE_LABELS: Record<string, string> = {
+    webhook: 'Webhook',
+    kanban: 'Канбан',
+    basic_analytics: 'Базовая аналитика',
+    advanced_analytics: 'Расширенная аналитика',
+    api: 'API',
+    '2fa': 'Двухфакторная аутентификация',
+    custom_domain: 'Свой домен',
+};
 
-/** Локализованный лейбл статуса транзакции. */
-export function statusLabel(status: TxStatus): string {
-    if (status === 'pending') return 'В обработке';
-    if (status === 'completed') return 'Проведён';
-    return 'Отклонено';
-}
-
-/** Лейбл формата файла счёта/УПД (PDF / 1С 8.3 XML). */
-export function formatLabel(format: InvoiceFormat): string {
-    if (format === 'pdf') return 'PDF';
-    return '1С 8.3 XML';
-}
-
-/** Иконка формата файла счёта/УПД. */
-export function formatIcon(format: InvoiceFormat): string {
-    if (format === 'pdf') return 'mdi-file-pdf-box';
-    return 'mdi-xml';
+/** Лейбл feature-слага; неизвестный слаг возвращается как есть. */
+export function featureLabel(slug: string): string {
+    return FEATURE_LABELS[slug] ?? slug;
 }

app/resources/js/composables/mockBilling.ts

@@ -1,167 +1,16 @@
 /**
- * Mock-данные для BillingView. Заменятся на API-fetch:
- *   GET /api/billing/wallet     — баланс ₽ + леды + tariff.
- *   GET /api/billing/transactions?type={all|topup|charge|refund} — `balance_transactions`.
- *   GET /api/billing/invoices   — `invoices` table (счета + УПД).
+ * Мок платежа «в обработке» для pending-баннера BillingView.
  *
- * Mock-структуры соответствуют схеме v8.7:
- * - balance_transactions (§4.4): type ∈ {topup, lead_charge, refund, tariff_charge, manager_addon}.
- * - invoices (§4.5): type ∈ {invoice, upd}, format ∈ {pdf, xml_1c83}.
+ * Кошелёк / транзакции / счета подключены к real API (api/billing.ts) в
+ * Sprint 2 Plan C (E3). Pending-баннер — отдельный эпик E4 (Sprint 5);
+ * до его реализации остаётся mock.
  */
-
-type TxType = 'topup' | 'lead_charge' | 'refund' | 'tariff_charge';
-export type TxStatus = 'pending' | 'completed' | 'rejected';
-
-export interface BillingTransaction {
-    id: number;
-    code: string; // 'TX-89421'
-    when: string; // '07.05 · 14:21'
-    type: TxType;
-    description: string;
-    status: TxStatus;
-    amount: number; // signed (+ topup/refund, − charge)
-}
-
-export const MOCK_TRANSACTIONS: BillingTransaction[] = [
-    {
-        id: 89421,
-        code: 'TX-89421',
-        when: '07.05 · 14:21',
-        type: 'topup',
-        description: 'Пополнение через ЮKassa',
-        status: 'pending',
-        amount: 5000,
-    },
-    {
-        id: 89384,
-        code: 'TX-89384',
-        when: '07.05 · 11:14',
-        type: 'lead_charge',
-        description: 'Списание · 3 лида проект «Окна Москва»',
-        status: 'completed',
-        amount: -6600,
-    },
-    {
-        id: 89370,
-        code: 'TX-89370',
-        when: '07.05 · 09:48',
-        type: 'refund',
-        description: 'Возврат лида #1018 · дубликат',
-        status: 'completed',
-        amount: 2200,
-    },
-    {
-        id: 89312,
-        code: 'TX-89312',
-        when: '06.05 · 22:06',
-        type: 'topup',
-        description: 'Пополнение через ЮKassa',
-        status: 'completed',
-        amount: 10000,
-    },
-    {
-        id: 89286,
-        code: 'TX-89286',
-        when: '06.05 · 18:32',
-        type: 'lead_charge',
-        description: 'Списание · 5 лидов проект «Натяжные потолки»',
-        status: 'completed',
-        amount: -9250,
-    },
-    {
-        id: 89108,
-        code: 'TX-89108',
-        when: '05.05 · 12:00',
-        type: 'tariff_charge',
-        description: 'Списание абонентской платы тарифа «Команда»',
-        status: 'completed',
-        amount: -990,
-    },
-    {
-        id: 88937,
-        code: 'TX-88937',
-        when: '04.05 · 16:42',
-        type: 'topup',
-        description: 'Попытка пополнения через банковский перевод',
-        status: 'rejected',
-        amount: 0,
-    },
-    {
-        id: 88714,
-        code: 'TX-88714',
-        when: '03.05 · 09:18',
-        type: 'refund',
-        description: 'Возврат лида #998 · спам',
-        status: 'completed',
-        amount: 1850,
-    },
-];
-
-export interface BillingTab {
-    id: 'all' | 'topup' | 'lead_charge' | 'refund';
-    label: string;
-    types: TxType[] | null;
-}
-
-export const BILLING_TABS: BillingTab[] = [
-    { id: 'all', label: 'Все', types: null },
-    { id: 'topup', label: 'Пополнения', types: ['topup'] },
-    { id: 'lead_charge', label: 'Списания', types: ['lead_charge', 'tariff_charge'] },
-    { id: 'refund', label: 'Возвраты', types: ['refund'] },
-];
-
-export type InvoiceFormat = 'pdf' | 'xml_1c83';
-
-export interface Invoice {
-    id: number;
-    when: string; // '07.05.2026'
-    title: string; // 'Счёт № 2026-0512'
-    sub: string; // 'Тариф «Команда» · май 2026'
-    amountRub: number;
-    format: InvoiceFormat;
-}
-
-export const MOCK_INVOICES: Invoice[] = [
-    {
-        id: 1,
-        when: '07.05.2026',
-        title: 'Счёт № 2026-0512',
-        sub: 'Тариф «Команда» · май 2026',
-        amountRub: 990,
-        format: 'pdf',
-    },
-    {
-        id: 2,
-        when: '06.05.2026',
-        title: 'УПД № УПД-2026-0492',
-        sub: 'Списания за апрель · 18 лидов',
-        amountRub: 29850,
-        format: 'xml_1c83',
-    },
-    {
-        id: 3,
-        when: '05.05.2026',
-        title: 'УПД № УПД-2026-0488',
-        sub: 'Списания за март · 24 лида',
-        amountRub: 38100,
-        format: 'xml_1c83',
-    },
-    {
-        id: 4,
-        when: '01.04.2026',
-        title: 'Счёт № 2026-0498',
-        sub: 'Тариф «Команда» · апрель 2026',
-        amountRub: 990,
-        format: 'pdf',
-    },
-];
-
 export interface PendingPayment {
     code: string;
     amount: number;
-    method: string; // 'ЮKassa'
-    startedAt: string; // '14:21'
-    autoCancelAt: string; // '14:51'
+    method: string;
+    startedAt: string;
+    autoCancelAt: string;
     timeoutMinutes: number;
 }
 

app/resources/js/composables/mockReports.ts

@@ -45,4 +45,5 @@ export interface ReportJob {
     progress: number | null; // 0..100 для running
     attempt: number; // 1..3
     error: string | null;
+    downloadUrl: string | null; // signed URL (24ч) скачивания готового файла; null для не-готовых
 }

app/resources/js/composables/reportsMapper.ts

@@ -43,6 +43,7 @@ export function mapApiReportJob(api: ApiReportJob, now: Date = new Date()): Repo
         progress: api.status === 'processing' ? 50 : null,
         attempt: api.retry_count + 1,
         error: api.error_message,
+        downloadUrl: api.download_url,
     };
 }
 

app/resources/js/composables/useCommandPalette.ts

@@ -0,0 +1,20 @@
+import { ref } from 'vue';
+
+/**
+ * Глобальное состояние command-palette (⌘K, audit B3). Module-level singleton
+ * ref — AppSidebar/AppTopbar открывают палитру без prop-drilling, CommandPalette
+ * (смонтирована один раз в AppLayout) использует тот же ref как v-model.
+ */
+const open = ref(false);
+
+export function useCommandPalette() {
+    return {
+        open,
+        openPalette: (): void => {
+            open.value = true;
+        },
+        closePalette: (): void => {
+            open.value = false;
+        },
+    };
+}

app/resources/js/histoire.setup.ts

@@ -12,7 +12,6 @@ export const setupVue3 = defineSetupVue3(({ app }) => {
             { path: '/register', component: { template: '<div />' } },
             { path: '/forgot', component: { template: '<div />' } },
             { path: '/2fa', component: { template: '<div />' } },
-            { path: '/recovery', component: { template: '<div />' } },
             { path: '/recovery-use', component: { template: '<div />' } },
             { path: '/dashboard', component: { template: '<div />' } },
             { path: '/deals', component: { template: '<div />' } },

app/resources/js/layouts/AdminLayout.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 /**
- * Layout админки SaaS — отдельный sidebar с пометкой ADMIN, 4 nav-пункта,
+ * Layout админки SaaS — отдельный sidebar с пометкой ADMIN, 7 nav-пунктов,
  * без user-chip как в обычной AppLayout.
  *
  * Источник дизайна: liderra_v8_handoff/concepts/v8_admin.html.
@@ -8,7 +8,6 @@
  *
  * Не входит в этот коммит:
  * - Auth-guard на /admin/* — должен проверять `super_admin` role + 2FA.
- * - Impersonation banner (когда admin вошёл «как клиент» — Ю-1: 15 мин / 5 попыток).
  * - Audit-log записей для всех action'ов admin (по schema v8.7 §10
  *   `saas_admin_audit_log`).
  */
@@ -16,6 +15,7 @@ import { useAuthStore } from '../stores/auth';
 import { computed } from 'vue';
 import { RouterView, useRoute, useRouter } from 'vue-router';
 import DevIndexBadge from '../components/DevIndexBadge.vue';
+import ImpersonationBanner from '../components/admin/ImpersonationBanner.vue';
 
 interface NavItem {
     title: string;
@@ -27,6 +27,8 @@ interface NavItem {
 const navItems: NavItem[] = [
     { title: 'Тенанты', icon: 'mdi-account-group-outline', to: '/admin/tenants', count: 142 },
     { title: 'Биллинг', icon: 'mdi-credit-card-outline', to: '/admin/billing' },
+    { title: 'Тарифная сетка', icon: 'mdi-tag-arrow-right', to: '/admin/pricing-tiers' },
+    { title: 'Цены поставщиков', icon: 'mdi-currency-rub', to: '/admin/supplier-prices' },
     { title: 'Инциденты', icon: 'mdi-alert-outline', to: '/admin/incidents', count: 3 },
     { title: 'Impersonation', icon: 'mdi-account-switch', to: '/admin/impersonation' },
     { title: 'Система', icon: 'mdi-cog-outline', to: '/admin/system' },
@@ -129,6 +131,7 @@ const currentPageTitle = computed(() => {
         </v-app-bar>
 
         <v-main class="admin-main">
+            <ImpersonationBanner />
             <RouterView />
         </v-main>
         <DevIndexBadge :index="route.meta.devIndex" :label="route.meta.devLabel" />

app/resources/js/layouts/AppLayout.vue

@@ -18,6 +18,7 @@ import { usePolling } from '../composables/usePolling';
 import AppSidebar from '../components/layout/AppSidebar.vue';
 import AppTopbar from '../components/layout/AppTopbar.vue';
 import DevIndexBadge from '../components/DevIndexBadge.vue';
+import CommandPalette from '../components/layout/CommandPalette.vue';
 
 const auth = useAuthStore();
 const notifications = useNotificationsStore();
@@ -73,6 +74,7 @@ usePolling(loadReminderCounts, { intervalMs: 60_000, enabled: true });
             </RouterView>
         </v-main>
         <DevIndexBadge :index="route.meta.devIndex" :label="route.meta.devLabel" />
+        <CommandPalette />
     </v-app>
 </template>
 

app/resources/js/layouts/AuthLayout.vue

@@ -1,6 +1,6 @@
 <script setup lang="ts">
 /**
- * Двухпанельный layout для экранов аутентификации (login/register/2fa/forgot/recovery).
+ * Двухпанельный layout для экранов аутентификации (login/register/2fa/forgot/recovery-use).
  *
  * Источник дизайна: liderra_v8_handoff/concepts/v8_login.html (CSS .layout grid 1fr 1fr,
  * .brand-pane слева тёмный теало-нуар + radial-gradient'ы, .form-pane справа warm ivory).
@@ -44,8 +44,8 @@ const route = useRoute();
                         </p>
                         <div class="bp-foot">
                             <span>v8 · Forest</span>
-                            <a href="/legal/offer">Оферта</a>
-                            <a href="/legal/privacy">Политика</a>
+                            <RouterLink to="/legal/offer">Оферта</RouterLink>
+                            <RouterLink to="/legal/privacy">Политика</RouterLink>
                         </div>
                     </div>
                 </v-col>

app/resources/js/router/index.ts

@@ -58,18 +58,18 @@ const routes: RouteRecordRaw[] = [
         component: () => import('../views/auth/ForgotPasswordView.vue'),
         meta: { layout: 'auth', title: 'Сброс пароля', guestOnly: true, devIndex: 4, devLabel: 'Forgot password' },
     },
-    {
-        path: '/recovery',
-        name: 'recovery',
-        component: () => import('../views/auth/RecoveryCodesView.vue'),
-        meta: { layout: 'auth', title: 'Резервные коды', devIndex: 6, devLabel: 'Recovery codes' },
-    },
     {
         path: '/recovery-use',
         name: 'recovery-use',
         component: () => import('../views/auth/UseRecoveryCodeView.vue'),
         meta: { layout: 'auth', title: 'Вход по резервному коду', devIndex: 7, devLabel: 'Use recovery' },
     },
+    {
+        path: '/legal/:doc(offer|privacy)',
+        name: 'legal',
+        component: () => import('../views/legal/LegalDocView.vue'),
+        meta: { layout: 'auth', title: 'Правовые документы' },
+    },
     {
         path: '/reset/:token',
         name: 'reset-password',
@@ -180,6 +180,19 @@ const routes: RouteRecordRaw[] = [
             devLabel: 'Напоминания',
         },
     },
+    {
+        path: '/import',
+        name: 'import',
+        component: () => import('../views/ImportView.vue'),
+        meta: {
+            layout: 'app',
+            title: 'Импорт данных',
+            requiresAuth: true,
+            transition: 'ld-route-fadeup',
+            devIndex: 29,
+            devLabel: 'Импорт данных',
+        },
+    },
     // Админка SaaS — отдельный layout с под-брендом ADMIN.
     // TODO: дополнительный role-guard на super_admin.
     {
@@ -210,6 +223,12 @@ const routes: RouteRecordRaw[] = [
         component: () => import('../views/admin/AdminIncidentsView.vue'),
         meta: { layout: 'admin', title: 'Инциденты', requiresAuth: true, devIndex: 24, devLabel: 'Admin Incidents' },
     },
+    {
+        path: '/admin/incidents/:id',
+        name: 'admin-incident-detail',
+        component: () => import('../views/admin/AdminIncidentDetailView.vue'),
+        meta: { layout: 'admin', title: 'Инцидент', requiresAuth: true },
+    },
     {
         path: '/admin/system',
         name: 'admin-system',

app/resources/js/stores/dealsCount.ts

@@ -0,0 +1,21 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import { fetchDealsCount } from '../api/deals';
+
+/**
+ * Счётчик сделок tenant'а для бейджа «Сделки» в AppSidebar (audit B2).
+ * count=null до загрузки или на fail → бейдж скрыт (resolveCount → 0).
+ */
+export const useDealsCountStore = defineStore('dealsCount', () => {
+    const count = ref<number | null>(null);
+
+    async function load(tenantId: number): Promise<void> {
+        try {
+            count.value = await fetchDealsCount(tenantId);
+        } catch {
+            count.value = null;
+        }
+    }
+
+    return { count, load };
+});

app/resources/js/views/BillingView.vue

@@ -1,47 +1,69 @@
 <script setup lang="ts">
 /**
  * Биллинг и тарифы — финансовый экран. Кошелёк ₽, баланс лидов,
- * текущий тариф, история транзакций и счета/УПД.
+ * текущий тариф, история транзакций и счета.
  *
- * Источник дизайна: liderra_v8_handoff/concepts/v8_billing.html.
- * MVP: page-head + pending banner + 3 wallet-cards (BalanceCard) +
- * transactions table с табами (TransactionsTable) + invoices list (InvoicesTable).
- * Mock-данные из composables/mockBilling.ts.
+ * Sprint 2 Plan C (E3): Overview-таб подвязан на real API
+ * (GET /api/billing/wallet → BalanceCard + шапка; TransactionsTable и
+ * InvoicesTable тянут данные сами). Списания — ChargesTab (Plan 4).
  *
- * Sprint 4 Phase B/2 — split на shell + 3 sub-components (audit O-refactor-04 хвост).
- *
- * Plan 4 Task 11 — добавлен top-level v-tabs split:
- *   - "Обзор" — существующий контент (mock-balance, transactions, invoices).
- *   - "Списания" — ChargesTab, real backend ledger (GET /api/billing/charges).
- *
- * Не входит в MVP:
- * - TopupDialog (диалог настройки автопополнения через ЮKassa).
- * - Tariff change wizard (диалог смены тарифа с расчётом разницы).
- * - Tariff comparison table (4 тарифа: Solo/Команда/Бизнес/Корпоративный).
- * - Refund-request dialog (заявка на возврат).
- *
- * Backend (отдельный коммит):
- * - GET /api/billing/wallet — балансы.
- * - GET /api/billing/transactions?type=...&page=... — пагинация.
- * - POST /api/billing/topup → ЮKassa-checkout.
- * - GET /api/billing/invoices/{id}/file — PDF/XML download.
+ * Pending-баннер остаётся mock (MOCK_PENDING) — это отдельный эпик E4
+ * (Sprint 5). TopupDialog «Пополнить баланс» — Task 5 (E1).
  */
-import { ref } from 'vue';
+import { ref, computed, onMounted } from 'vue';
 import BalanceCard from '../components/billing/BalanceCard.vue';
 import TransactionsTable from '../components/billing/TransactionsTable.vue';
 import InvoicesTable from '../components/billing/InvoicesTable.vue';
+import TopupDialog from '../components/billing/TopupDialog.vue';
 import ChargesTab from './billing/ChargesTab.vue';
 import { MOCK_PENDING } from '../composables/mockBilling';
-import { formatPlain } from '../composables/billingFormatters';
-
-const walletRub = 14250;
-const leadsBalance = 285;
-const runwayDays = 4;
-const tariffName = 'Команда';
-const tariffPrice = 990;
-const tariffFeatures = ['до 10 проектов', '4 менеджера + расширение', 'Канбан, Webhook, API'];
+import { formatPlain, featureLabel } from '../composables/billingFormatters';
+import { getWallet, type Wallet } from '../api/billing';
+import { extractErrorMessage } from '../api/client';
 
 const activeView = ref<'overview' | 'charges'>('overview');
+
+const wallet = ref<Wallet | null>(null);
+const loading = ref(true);
+const loadError = ref<string | null>(null);
+const topupOpen = ref(false);
+const topupSnackbar = ref(false);
+const txTableRef = ref<InstanceType<typeof TransactionsTable> | null>(null);
+
+const walletRub = computed(() => Number(wallet.value?.balance_rub ?? 0));
+const leadsBalance = computed(() => wallet.value?.balance_leads ?? 0);
+const runwayDays = computed(() => wallet.value?.runway_days ?? null);
+const tariffName = computed(() => wallet.value?.tariff?.name ?? null);
+const tariffPrice = computed(() => wallet.value?.tariff?.price_monthly ?? null);
+const tariffFeatures = computed<string[]>(() => (wallet.value?.tariff?.features ?? []).map(featureLabel));
+
+async function loadWallet(): Promise<void> {
+    loading.value = true;
+    loadError.value = null;
+    try {
+        wallet.value = await getWallet();
+    } catch (e) {
+        // Сброс устаревших данных: при неудачном повторе не оставляем
+        // прошлый успешный wallet в памяти (защита от ложного рендера).
+        wallet.value = null;
+        loadError.value = extractErrorMessage(e, 'Не удалось загрузить данные биллинга.');
+    } finally {
+        loading.value = false;
+    }
+}
+
+async function onTopupSuccess(): Promise<void> {
+    // success-событие несёт новый баланс, но мы намеренно перезапрашиваем
+    // кошелёк (loadWallet) — единый источник истины надёжнее точечного патча.
+    topupOpen.value = false;
+    topupSnackbar.value = true;
+    await loadWallet();
+    txTableRef.value?.refresh();
+}
+
+onMounted(loadWallet);
+
+defineExpose({ loadWallet, wallet, topupOpen });
 </script>
 
 <template>
@@ -49,7 +71,7 @@ const activeView = ref<'overview' | 'charges'>('overview');
         <header class="page-head">
             <div>
                 <h1 class="text-h4 mb-2 page-title">Биллинг и тарифы</h1>
-                <div class="page-stats text-body-2 text-medium-emphasis">
+                <div v-if="wallet" class="page-stats text-body-2 text-medium-emphasis">
                     <span
                         ><span class="num text-primary">{{ formatPlain(walletRub) }}</span> кошелёк</span
                     >
@@ -57,13 +79,17 @@ const activeView = ref<'overview' | 'charges'>('overview');
                     <span
                         ><span class="num">{{ leadsBalance }}</span> лидов запас</span
                     >
-                    <span class="sep">·</span>
-                    <span
-                        >хватит на <span class="num">{{ runwayDays }} дня</span></span
-                    >
+                    <template v-if="runwayDays !== null">
+                        <span class="sep">·</span>
+                        <span
+                            >хватит на <span class="num">{{ runwayDays }}</span> дн.</span
+                        >
+                    </template>
                 </div>
             </div>
-            <v-btn color="primary" variant="flat" prepend-icon="mdi-plus">Пополнить баланс</v-btn>
+            <v-btn color="primary" variant="flat" prepend-icon="mdi-plus" @click="topupOpen = true"
+                >Пополнить баланс</v-btn
+            >
         </header>
 
         <v-tabs v-model="activeView" color="primary" class="mt-4">
@@ -73,30 +99,56 @@ const activeView = ref<'overview' | 'charges'>('overview');
 
         <v-tabs-window v-model="activeView">
             <v-tabs-window-item value="overview">
-                <v-alert v-if="MOCK_PENDING" type="info" variant="tonal" density="compact" class="mt-4" role="status">
-                    <strong>1 платёж в обработке</strong> — {{ formatPlain(MOCK_PENDING.amount) }} от
-                    {{ MOCK_PENDING.method }}, начат {{ MOCK_PENDING.startedAt }}. Авто-восстановление в
-                    {{ MOCK_PENDING.autoCancelAt }} ({{ MOCK_PENDING.timeoutMinutes }} мин). Кнопки «Отменить» нет — это
-                    техническое решение.
+                <div v-if="loading" class="py-12 d-flex justify-center">
+                    <v-progress-circular indeterminate color="primary" />
+                </div>
+
+                <v-alert v-else-if="loadError" type="error" variant="tonal" class="mt-4" role="alert">
+                    {{ loadError }}
+                    <template #append>
+                        <v-btn size="small" variant="text" @click="loadWallet">Повторить</v-btn>
+                    </template>
                 </v-alert>
 
-                <BalanceCard
-                    :wallet-rub="walletRub"
-                    :leads-balance="leadsBalance"
-                    :tariff-name="tariffName"
-                    :tariff-price="tariffPrice"
-                    :tariff-features="tariffFeatures"
-                />
+                <template v-else-if="wallet">
+                    <v-alert
+                        v-if="MOCK_PENDING"
+                        type="info"
+                        variant="tonal"
+                        density="compact"
+                        class="mt-4"
+                        role="status"
+                    >
+                        <strong>1 платёж в обработке</strong> — {{ formatPlain(MOCK_PENDING.amount) }} от
+                        {{ MOCK_PENDING.method }}, начат {{ MOCK_PENDING.startedAt }}. Авто-восстановление в
+                        {{ MOCK_PENDING.autoCancelAt }} ({{ MOCK_PENDING.timeoutMinutes }} мин).
+                    </v-alert>
 
-                <TransactionsTable />
+                    <BalanceCard
+                        :wallet-rub="walletRub"
+                        :leads-balance="leadsBalance"
+                        :tariff-name="tariffName"
+                        :tariff-price="tariffPrice"
+                        :tariff-features="tariffFeatures"
+                        @topup="topupOpen = true"
+                    />
 
-                <InvoicesTable />
+                    <TransactionsTable ref="txTableRef" />
+
+                    <InvoicesTable />
+                </template>
             </v-tabs-window-item>
 
             <v-tabs-window-item value="charges">
                 <ChargesTab />
             </v-tabs-window-item>
         </v-tabs-window>
+
+        <TopupDialog v-model="topupOpen" @success="onTopupSuccess" />
+
+        <v-snackbar v-model="topupSnackbar" color="success" :timeout="4000">
+            Баланс пополнен.
+        </v-snackbar>
     </v-container>
 </template>
 
@@ -123,7 +175,7 @@ const activeView = ref<'overview' | 'charges'>('overview');
     align-items: center;
 }
 .page-stats .sep {
-    /* WCAG2AA 4.5:1 fix (was #92907b → 2.92:1 on ivory; #6b6356 → 5.33:1). */
+    /* WCAG2AA 4.5:1: #6b6356 → 5.33:1 on ivory. */
     color: #6b6356;
 }
 

app/resources/js/views/DashboardView.vue

@@ -1,67 +1,103 @@
 <script setup lang="ts">
 /**
- * Дашборд — стартовая страница для авторизованных пользователей.
- *
- * Источник дизайна: liderra_v8_handoff/concepts/v8_dashboard.html.
- * MVP: page-head + 4 KPI-cards (получено лидов / конверсия / активные проекты /
- * баланс). Графики (Активность по дням, Воронка из 14 статусов).
- *
- * Все числа сейчас mock'и — TODO: GET /api/dashboard/summary с tenant-context'ом
- * по middleware SetTenantContext (фаза backend).
- *
- * Sprint 4 Phase B/3 — split на DashboardPageHead + DashboardKpiRow +
- * DashboardBalance (audit O-refactor-04 закрытие). State (range, kpis, balance)
- * остаётся в parent ради единого mock-data flow и future API-fetch'а.
- *
- * Примечание: «recent deals list» в Phase B/3 plan'е — на текущем дашборде нет
- * (есть только charts row); если будет добавлено в будущем — выносится в
- * DashboardRecentDeals.vue по аналогии.
+ * Дашборд — стартовая страница. Audit C1/J3: KPI/баланс/активность/воронка
+ * грузятся из GET /api/dashboard/summary; при ошибке — fallback на mock,
+ * чтобы UI оставался работоспособным (dev / отсутствие backend).
  */
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 import ActivityChart from '../components/charts/ActivityChart.vue';
 import FunnelChart from '../components/charts/FunnelChart.vue';
 import DashboardPageHead from '../components/dashboard/DashboardPageHead.vue';
 import DashboardKpiRow, { type Kpi } from '../components/dashboard/DashboardKpiRow.vue';
 import DashboardBalance, { type Balance } from '../components/dashboard/DashboardBalance.vue';
+import { getDashboardSummary, type DashboardRange, type DashboardSummary } from '../api/dashboard';
+import { useAuthStore } from '../stores/auth';
 
-const range = ref<'today' | '7d' | '30d' | 'custom'>('7d');
+const auth = useAuthStore();
+const range = ref<DashboardRange | 'custom'>('7d');
 
-const kpis: Kpi[] = [
-    {
-        label: 'Получено лидов',
-        value: '247',
-        delta: { dir: 'up', text: '12.3%' },
-        sub: 'vs предыдущие 7 дней',
-    },
-    {
-        label: 'Конверсия в оплату',
-        value: '18.4',
-        unit: '%',
-        delta: { dir: 'up', text: '2.1pp' },
-        sub: 'vs предыдущие 7 дней',
-    },
-    {
-        label: 'Активные проекты',
-        value: '8',
-        unit: '/ 10',
-        delta: { dir: 'neutral', text: '2 свободно' },
-        sub: 'тариф «Команда»',
-    },
+// runwayMax — display-константа полосы (7 сегментов), не из API.
+const RUNWAY_MAX = 7;
+
+// Mock-fallback — UI работоспособен без backend (dev / 500 / нет auth).
+const MOCK_KPIS: Kpi[] = [
+    { label: 'Получено лидов', value: '247', delta: { dir: 'up', text: '12.3%' }, sub: 'vs предыдущий период' },
+    { label: 'Конверсия в оплату', value: '18.4', unit: '%', delta: { dir: 'up', text: '2.1pp' }, sub: 'vs предыдущий период' },
+    { label: 'Активные проекты', value: '8', unit: '/ 10', delta: { dir: 'neutral', text: '' }, sub: 'лимит тарифа' },
 ];
+const MOCK_BALANCE: Balance = { amount: '14 250', runwayDays: 4, runwayMax: RUNWAY_MAX, runwayLeads: 285 };
 
-const balance: Balance = {
-    amount: '14 250',
-    runwayDays: 4,
-    runwayMax: 7,
-    runwayLeads: 285,
-};
+const kpis = ref<Kpi[]>(MOCK_KPIS);
+const balance = ref<Balance>(MOCK_BALANCE);
+const activityPoints = ref<number[]>([16, 31, 27, 47, 39, 56, 50]);
+const activityLabels = ref<string[]>(['пн', 'вт', 'ср', 'чт', 'пт', 'сб', 'сегодня']);
+const activityMax = ref(60);
+const funnelCounts = ref<Record<string, number> | undefined>(undefined);
+const fetchError = ref(false);
+
+/** Форматирует число с пробелами-разделителями тысяч ('14250.00' → '14 250'). */
+function formatRub(raw: string): string {
+    const n = parseFloat(raw);
+    if (!Number.isFinite(n)) return '0';
+    const int = Math.round(n).toString();
+    return int.replace(/\B(?=(\d{3})+(?!\d))/g, ' ');
+}
+
+function applySummary(s: DashboardSummary): void {
+    kpis.value = [
+        {
+            label: 'Получено лидов',
+            value: String(s.leads_received.value),
+            delta: { dir: s.leads_received.delta_dir, text: `${s.leads_received.delta_pct}%` },
+            sub: 'vs предыдущий период',
+        },
+        {
+            label: 'Конверсия в оплату',
+            value: String(s.conversion.value),
+            unit: '%',
+            delta: { dir: s.conversion.delta_dir, text: `${s.conversion.delta_pp}pp` },
+            sub: 'vs предыдущий период',
+        },
+        {
+            label: 'Активные проекты',
+            value: String(s.active_projects.active),
+            unit: `/ ${s.active_projects.limit}`,
+            delta: { dir: 'neutral', text: '' },
+            sub: 'лимит тарифа',
+        },
+    ];
+    balance.value = {
+        amount: formatRub(s.balance.amount_rub),
+        runwayDays: Math.min(s.balance.runway_days, RUNWAY_MAX),
+        runwayMax: RUNWAY_MAX,
+        runwayLeads: s.balance.runway_leads,
+    };
+    activityPoints.value = s.activity.points;
+    activityLabels.value = s.activity.labels;
+    activityMax.value = s.activity.max;
+    funnelCounts.value = s.funnel;
+}
+
+async function load(): Promise<void> {
+    const tenantId = auth.user?.tenant_id;
+    if (!tenantId || range.value === 'custom') return;
+    try {
+        applySummary(await getDashboardSummary(tenantId, range.value as DashboardRange));
+        fetchError.value = false;
+    } catch {
+        fetchError.value = true; // оставляем последнее значение / mock
+    }
+}
+
+watch(range, load);
+load();
 </script>
 
 <template>
     <v-container fluid class="dashboard pa-6">
         <DashboardPageHead v-model="range" />
 
-        <div class="ld-meta mt-2">
+        <div v-show="!fetchError" class="ld-meta mt-2">
             <span class="ld-pulse" aria-hidden="true"></span>
             <span>Live · обновлено только что</span>
         </div>
@@ -71,12 +107,23 @@ const balance: Balance = {
             <DashboardBalance :balance="balance" />
         </v-row>
 
+        <v-alert
+            v-if="fetchError"
+            type="warning"
+            variant="tonal"
+            density="compact"
+            class="mt-3"
+            data-testid="dashboard-fetch-error"
+        >
+            Не удалось обновить данные дашборда — показаны последние известные значения.
+        </v-alert>
+
         <v-row class="charts-row mt-4">
             <v-col cols="12" md="7">
-                <ActivityChart />
+                <ActivityChart :points="activityPoints" :labels="activityLabels" :max="activityMax" />
             </v-col>
             <v-col cols="12" md="5">
-                <FunnelChart />
+                <FunnelChart :counts="funnelCounts" />
             </v-col>
         </v-row>
     </v-container>

app/resources/js/views/DealsView.vue

@@ -13,7 +13,8 @@
  *
  * Источник статусов — composables/leadStatuses.ts (snapshot из db/schema.sql:2130).
  */
-import { computed, defineAsyncComponent, onMounted, reactive, ref } from 'vue';
+import { computed, defineAsyncComponent, onMounted, reactive, ref, watch } from 'vue';
+import { useRoute } from 'vue-router';
 import { DEALS_TABS, MOCK_DEALS, type MockDeal } from '../composables/mockDeals';
 import { mapApiDeal } from '../composables/dealsApiMapper';
 import { usePolling } from '../composables/usePolling';
@@ -37,13 +38,64 @@ import { buildCsvString, triggerBlobDownload, triggerCsvDownload } from '../comp
 // Task 15: density-toggle composable (persists в localStorage, влияет на row height).
 const { rowHeight } = useDensity();
 
-// Task 15: stub-обработчики redesign-filter-chip'ов. На I1 — popover'ы Проект/Менеджер
-// не реализованы; chiprow служит quiet-luxury визуальной заменой для status-summary'ов.
-// Не ломает существующие VSelect'ы в DealsFilters — те остаются как полноценный filter UI.
+// Sprint 1 C2: popovers для Проект/Менеджер chip'ов. Draft-state накапливает
+// выбор внутри v-menu; копируется из filterProjects/filterManagers при открытии
+// (watch на menu open=true); переносится обратно в filterProjects/Managers на
+// «Применить» button. Status chip — read-only (P2 backlog Sprint 5).
+const projectMenuOpen = ref(false);
+const managerMenuOpen = ref(false);
+const projectMenuDraft = ref<string[]>([]);
+const managerMenuDraft = ref<string[]>([]);
+
+// При открытии меню — копируем текущий filter в draft (snapshot-on-open).
+// При закрытии без apply — draft остаётся, но не влияет на filterProjects
+// (apply нужен явно).
+watch(projectMenuOpen, (isOpen) => {
+    if (isOpen) projectMenuDraft.value = [...filterProjects.value];
+});
+watch(managerMenuOpen, (isOpen) => {
+    if (isOpen) managerMenuDraft.value = [...filterManagers.value];
+});
+
 function onRedesignFilterClick(name: string): void {
-    console.log(`[redesign filterbar] ${name} clicked — popover TBD`);
+    // Status chip — read-only summary (P2 backlog Sprint 5).
+    // Project/Manager managed by v-menu activator (no manual click handler needed).
+    if (name === 'Статус') {
+        // no-op — placeholder для будущей реализации
+    }
 }
 
+function applyProjectFilter(): void {
+    filterProjects.value = [...projectMenuDraft.value];
+    projectMenuOpen.value = false;
+}
+
+function applyManagerFilter(): void {
+    filterManagers.value = [...managerMenuDraft.value];
+    managerMenuOpen.value = false;
+}
+
+function clearProjectDraft(): void {
+    projectMenuDraft.value = [];
+}
+
+function clearManagerDraft(): void {
+    managerMenuDraft.value = [];
+}
+
+function toggleProjectDraft(proj: string): void {
+    projectMenuDraft.value = projectMenuDraft.value.includes(proj)
+        ? projectMenuDraft.value.filter((p) => p !== proj)
+        : [...projectMenuDraft.value, proj];
+}
+
+function toggleManagerDraft(name: string): void {
+    managerMenuDraft.value = managerMenuDraft.value.includes(name)
+        ? managerMenuDraft.value.filter((m) => m !== name)
+        : [...managerMenuDraft.value, name];
+}
+
+const route = useRoute();
 const auth = useAuthStore();
 const leadStatusesStore = useLeadStatusesStore();
 
@@ -115,11 +167,17 @@ async function applyBulkRestoreFromTrash() {
     deleteToastOpen.value = true;
 }
 
-onMounted(() => {
+onMounted(async () => {
     void leadStatusesStore.load();
-    void loadDeals();
+    await loadDeals();
+    openDealFromQuery();
 });
 
+watch(
+    () => route.query.openId,
+    () => openDealFromQuery(),
+);
+
 // Polling — каждые 30 сек авто-refresh dealsState. Pause при скрытой вкладке.
 // Включается только при наличии auth.user (без auth listDeals = no-op anyway).
 usePolling(loadDeals);
@@ -168,6 +226,16 @@ function openDeal(deal: MockDeal) {
     drawerOpen.value = true;
 }
 
+/** Audit C8/F3: deep-link — открыть drawer сделки по ?openId= из URL. */
+function openDealFromQuery(): void {
+    const raw = route.query.openId;
+    const id = Number(Array.isArray(raw) ? raw[0] : raw);
+    if (!Number.isInteger(id) || id <= 0) return;
+    if (selectedDeal.value?.id === id) return;
+    const deal = dealsState.find((d) => d.id === id);
+    if (deal) openDeal(deal);
+}
+
 async function applyBulkStatus(slug: MockDeal['statusSlug']) {
     const ids = [...selected.value];
     statusMenuOpen.value = false;
@@ -277,25 +345,42 @@ async function applyBulkExport(format: 'xlsx' | 'csv' = 'xlsx') {
         exportToastOpen.value = true;
         return;
     }
+    await exportDealIds([...selected.value], format);
+}
 
-    // С tenant_id — backend (RLS-фильтрация чужих id). На fail — fallback на
-    // local CSV (даже если запросили xlsx — без backend'а xlsx не построим).
+// Audit C3: экспорт всех отфильтрованных сделок — кнопка «Экспорт» в page-head.
+async function exportAllFiltered(format: 'xlsx' | 'csv' = 'xlsx') {
+    const ids = filteredDeals.value.map((d) => d.id);
+    if (ids.length === 0) {
+        exportToastText.value = 'Список пуст — нечего экспортировать.';
+        exportToastOpen.value = true;
+        return;
+    }
+    await exportDealIds(ids, format);
+}
+
+/**
+ * Общий экспорт по списку id. С tenant_id — backend (RLS-фильтрация чужих id).
+ * На fail / без tenant — fallback на локальный CSV.
+ */
+async function exportDealIds(ids: number[], format: 'xlsx' | 'csv') {
+    exportToastText.value = '';
     if (auth.user?.tenant_id) {
         try {
             if (format === 'xlsx') {
                 const blob = await dealsApi.exportDealsXlsx({
                     tenant_id: auth.user.tenant_id,
-                    ids: selected.value,
+                    ids,
                 });
                 triggerBlobDownload(blob, `deals_export_${new Date().toISOString().slice(0, 10)}.xlsx`);
-                exportToastText.value = `Экспортировано ${selected.value.length} сделок в XLSX.`;
+                exportToastText.value = `Экспортировано ${ids.length} сделок в XLSX.`;
             } else {
                 const csv = await dealsApi.exportDeals({
                     tenant_id: auth.user.tenant_id,
-                    ids: selected.value,
+                    ids,
                 });
                 triggerCsvDownload(csv, `deals_export_${new Date().toISOString().slice(0, 10)}.csv`);
-                exportToastText.value = `Экспортировано ${selected.value.length} сделок в CSV.`;
+                exportToastText.value = `Экспортировано ${ids.length} сделок в CSV.`;
             }
             exportToastOpen.value = true;
             return;
@@ -304,11 +389,11 @@ async function applyBulkExport(format: 'xlsx' | 'csv' = 'xlsx') {
         }
     }
 
-    buildLocalCsv();
+    buildLocalCsv(ids);
 }
 
-function buildLocalCsv() {
-    const idSet = new Set(selected.value);
+function buildLocalCsv(ids: number[]) {
+    const idSet = new Set(ids);
     const rows = dealsState.filter((d) => idSet.has(d.id));
     const headers = ['ID', 'Имя', 'Телефон', 'Статус', 'Проект', 'Менеджер', 'Стоимость', 'Получено мин назад'];
     const csv = buildCsvString(
@@ -330,6 +415,7 @@ defineExpose({
     applyBulkStatus,
     applyBulkDelete,
     applyBulkExport,
+    exportAllFiltered,
     exportToastOpen,
     exportToastText,
     onDealCreated,
@@ -350,6 +436,18 @@ defineExpose({
     trashMode,
     toggleTrashMode,
     applyBulkRestoreFromTrash,
+    projectMenuOpen,
+    managerMenuOpen,
+    projectMenuDraft,
+    managerMenuDraft,
+    applyProjectFilter,
+    applyManagerFilter,
+    clearProjectDraft,
+    clearManagerDraft,
+    toggleProjectDraft,
+    toggleManagerDraft,
+    drawerOpen,
+    selectedDeal,
 });
 
 const leadStatuses = computed(() => leadStatusesStore.statuses);
@@ -433,7 +531,15 @@ const waitingPay = computed(() => dealsState.filter((d) => d.statusSlug === 'wai
                 >
                     {{ trashMode ? 'К сделкам' : 'Корзина' }}
                 </v-btn>
-                <v-btn v-if="!trashMode" variant="outlined" prepend-icon="mdi-download">Экспорт</v-btn>
+                <v-btn
+                    v-if="!trashMode"
+                    variant="outlined"
+                    prepend-icon="mdi-download"
+                    data-testid="export-all-btn"
+                    @click="exportAllFiltered()"
+                >
+                    Экспорт
+                </v-btn>
                 <v-btn
                     v-if="!trashMode"
                     color="primary"
@@ -463,10 +569,9 @@ const waitingPay = computed(() => dealsState.filter((d) => d.statusSlug === 'wai
             @clear-filters="clearFilters"
         />
 
-        <!-- Task 15: redesign-filterbar (quiet luxury chiprow + density toggle).
-             Минимальный набор: 3 FilterChip-ярлыка (Статус/Проект/Менеджер) + DensityToggle справа.
-             Клики на I1 — stub'ы (popover'ы — TBD); полноценные multi-select'ы остаются в DealsFilters выше.
-             Status-legend ниже визуализирует пул цветов StatusPill'ов воронки. -->
+        <!-- Sprint 1 C2: redesign-filterbar с popover'ами для Проект/Менеджер.
+             Status chip остаётся read-only (P2 backlog Sprint 5).
+             Полноценные multi-select'ы в DealsFilters выше сохранены. -->
         <div v-if="!trashMode" class="ld-filterbar mt-3">
             <div class="ld-filterbar__chips">
                 <FilterChip
@@ -475,18 +580,109 @@ const waitingPay = computed(() => dealsState.filter((d) => d.statusSlug === 'wai
                     :active="false"
                     @click="onRedesignFilterClick('Статус')"
                 />
-                <FilterChip
-                    label="Проект"
-                    :count="filterProjects.length"
-                    :active="filterProjects.length > 0"
-                    @click="onRedesignFilterClick('Проект')"
-                />
-                <FilterChip
-                    label="Менеджер"
-                    :count="filterManagers.length"
-                    :active="filterManagers.length > 0"
-                    @click="onRedesignFilterClick('Менеджер')"
-                />
+                <v-menu v-model="projectMenuOpen" :close-on-content-click="false" location="bottom start">
+                    <template #activator="{ props: activatorProps }">
+                        <span v-bind="activatorProps">
+                            <FilterChip
+                                label="Проект"
+                                :count="filterProjects.length"
+                                :active="filterProjects.length > 0"
+                            />
+                        </span>
+                    </template>
+                    <v-card min-width="260" max-width="320" data-testid="project-menu-card">
+                        <v-card-text class="pa-2">
+                            <v-list density="compact" class="pa-0">
+                                <v-list-item v-if="availableProjects.length === 0" class="text-medium-emphasis">
+                                    <v-list-item-title>Нет проектов в текущем списке</v-list-item-title>
+                                </v-list-item>
+                                <v-list-item
+                                    v-for="proj in availableProjects"
+                                    :key="proj"
+                                    class="py-1"
+                                    @click="toggleProjectDraft(proj)"
+                                >
+                                    <template #prepend>
+                                        <v-checkbox-btn :model-value="projectMenuDraft.includes(proj)" />
+                                    </template>
+                                    <v-list-item-title>{{ proj }}</v-list-item-title>
+                                </v-list-item>
+                            </v-list>
+                        </v-card-text>
+                        <v-card-actions class="px-3 pb-2">
+                            <v-btn
+                                variant="text"
+                                size="small"
+                                data-testid="project-menu-clear"
+                                @click="clearProjectDraft"
+                            >
+                                Очистить
+                            </v-btn>
+                            <v-spacer />
+                            <v-btn
+                                color="primary"
+                                variant="flat"
+                                size="small"
+                                data-testid="project-menu-apply"
+                                @click="applyProjectFilter"
+                            >
+                                Применить
+                            </v-btn>
+                        </v-card-actions>
+                    </v-card>
+                </v-menu>
+                <v-menu v-model="managerMenuOpen" :close-on-content-click="false" location="bottom start">
+                    <template #activator="{ props: activatorProps }">
+                        <span v-bind="activatorProps">
+                            <FilterChip
+                                label="Менеджер"
+                                :count="filterManagers.length"
+                                :active="filterManagers.length > 0"
+                            />
+                        </span>
+                    </template>
+                    <v-card min-width="260" max-width="320" data-testid="manager-menu-card">
+                        <v-card-text class="pa-2">
+                            <v-list density="compact" class="pa-0">
+                                <v-list-item v-if="availableManagers.length === 0" class="text-medium-emphasis">
+                                    <v-list-item-title>Нет менеджеров в текущем списке</v-list-item-title>
+                                </v-list-item>
+                                <v-list-item
+                                    v-for="mgr in availableManagers"
+                                    :key="mgr.name"
+                                    class="py-1"
+                                    @click="toggleManagerDraft(mgr.name)"
+                                >
+                                    <template #prepend>
+                                        <v-checkbox-btn :model-value="managerMenuDraft.includes(mgr.name)" />
+                                    </template>
+                                    <v-list-item-title>{{ mgr.name }}</v-list-item-title>
+                                    <v-list-item-subtitle class="text-caption">{{ mgr.initials }}</v-list-item-subtitle>
+                                </v-list-item>
+                            </v-list>
+                        </v-card-text>
+                        <v-card-actions class="px-3 pb-2">
+                            <v-btn
+                                variant="text"
+                                size="small"
+                                data-testid="manager-menu-clear"
+                                @click="clearManagerDraft"
+                            >
+                                Очистить
+                            </v-btn>
+                            <v-spacer />
+                            <v-btn
+                                color="primary"
+                                variant="flat"
+                                size="small"
+                                data-testid="manager-menu-apply"
+                                @click="applyManagerFilter"
+                            >
+                                Применить
+                            </v-btn>
+                        </v-card-actions>
+                    </v-card>
+                </v-menu>
             </div>
             <DensityToggle class="ld-filterbar__density" />
         </div>

app/resources/js/views/ImportView.vue

@@ -0,0 +1,240 @@
+<script setup lang="ts">
+/**
+ * Импорт данных — загрузка CSV исторических лидов из crm.bp-gr.ru (ТЗ §6).
+ *
+ * Flow: выбрать файл → загрузить → polling прогресса → таблица результата.
+ * Неизвестные статусы маппятся через UnknownStatusesDialog.
+ */
+import { computed, onMounted, onUnmounted, ref } from 'vue';
+import {
+    getImport,
+    getUnknownStatuses,
+    listImports,
+    uploadImport,
+    type ImportLogResource,
+    type UnknownStatus,
+} from '../api/imports';
+import UnknownStatusesDialog from '../components/import/UnknownStatusesDialog.vue';
+
+const file = ref<File | null>(null);
+const dryRun = ref(false);
+const uploading = ref(false);
+const errorMessage = ref<string | null>(null);
+const history = ref<ImportLogResource[]>([]);
+const activeImport = ref<ImportLogResource | null>(null);
+const unknownStatuses = ref<UnknownStatus[]>([]);
+const wizardOpen = ref(false);
+
+/** Интервал опроса прогресса активного импорта, мс. */
+const POLL_INTERVAL_MS = 2000;
+
+let pollTimer: ReturnType<typeof setInterval> | null = null;
+
+const canUpload = computed(() => file.value !== null && !uploading.value);
+const isProcessing = computed(
+    () =>
+        activeImport.value?.status === 'pending' ||
+        activeImport.value?.status === 'processing',
+);
+
+async function refreshHistory(): Promise<void> {
+    try {
+        history.value = await listImports();
+    } catch {
+        // история — не критично, тихо игнорируем
+    }
+}
+
+async function refreshUnknown(): Promise<void> {
+    try {
+        unknownStatuses.value = await getUnknownStatuses();
+    } catch {
+        unknownStatuses.value = [];
+    }
+}
+
+function stopPolling(): void {
+    if (pollTimer !== null) {
+        clearInterval(pollTimer);
+        pollTimer = null;
+    }
+}
+
+async function pollOnce(id: number): Promise<void> {
+    try {
+        activeImport.value = await getImport(id);
+        if (!isProcessing.value) {
+            stopPolling();
+            await refreshHistory();
+            await refreshUnknown();
+        }
+    } catch {
+        stopPolling();
+    }
+}
+
+function startPolling(id: number): void {
+    stopPolling();
+    pollTimer = setInterval(() => {
+        void pollOnce(id);
+    }, POLL_INTERVAL_MS);
+}
+
+async function submit(): Promise<void> {
+    if (file.value === null) {
+        return;
+    }
+    uploading.value = true;
+    errorMessage.value = null;
+    try {
+        activeImport.value = await uploadImport(file.value, dryRun.value);
+        startPolling(activeImport.value.id);
+        file.value = null;
+    } catch {
+        errorMessage.value = 'Не удалось загрузить файл. Проверьте формат (CSV, до 10 МБ).';
+    } finally {
+        uploading.value = false;
+    }
+}
+
+async function onWizardResolved(): Promise<void> {
+    wizardOpen.value = false;
+    await refreshUnknown();
+}
+
+onMounted(async () => {
+    await refreshHistory();
+    await refreshUnknown();
+});
+
+onUnmounted(stopPolling);
+</script>
+
+<template>
+    <v-container fluid class="import-view pa-6">
+        <header class="page-head mb-4">
+            <h1 class="text-h4 mb-2">Импорт данных</h1>
+            <p class="text-body-2 text-medium-emphasis ma-0">
+                Перенос исторических лидов из crm.bp-gr.ru. Формат — CSV-выгрузка (UTF-8).
+            </p>
+        </header>
+
+        <v-alert
+            v-if="unknownStatuses.length > 0"
+            data-test="unknown-banner"
+            type="warning"
+            variant="tonal"
+            class="mb-4"
+        >
+            Найдено {{ unknownStatuses.length }} неизвестных статусов воронки — замапьте вручную.
+            <template #append>
+                <v-btn size="small" variant="flat" @click="wizardOpen = true">Замапить</v-btn>
+            </template>
+        </v-alert>
+
+        <v-card variant="outlined" class="pa-6 mb-6">
+            <v-file-input
+                v-model="file"
+                label="CSV-файл выгрузки лидов"
+                accept=".csv,text/csv"
+                prepend-icon="mdi-database-import-outline"
+                variant="outlined"
+                density="comfortable"
+                :disabled="uploading"
+            />
+            <v-checkbox
+                v-model="dryRun"
+                label="Пробный прогон (проверить файл без записи сделок)"
+                density="compact"
+                hide-details
+            />
+            <v-alert v-if="errorMessage" type="error" variant="tonal" class="mt-3">
+                {{ errorMessage }}
+            </v-alert>
+            <div class="mt-4">
+                <v-btn
+                    data-test="upload-btn"
+                    color="primary"
+                    :loading="uploading"
+                    :disabled="!canUpload"
+                    @click="submit"
+                >
+                    Загрузить
+                </v-btn>
+            </div>
+        </v-card>
+
+        <v-card v-if="activeImport" variant="outlined" class="pa-6 mb-6">
+            <h2 class="text-h6 mb-3">Текущий импорт — {{ activeImport.filename }}</h2>
+            <v-progress-linear v-if="isProcessing" indeterminate color="primary" class="mb-3" />
+            <div data-test="active-status" class="text-body-2">
+                Статус: <strong>{{ activeImport.status }}</strong>
+            </div>
+            <v-table v-if="!isProcessing" density="compact" class="mt-3">
+                <tbody>
+                    <tr>
+                        <td>Добавлено</td>
+                        <td>{{ activeImport.rows_added }}</td>
+                    </tr>
+                    <tr>
+                        <td>Обновлено</td>
+                        <td>{{ activeImport.rows_updated }}</td>
+                    </tr>
+                    <tr>
+                        <td>Пропущено</td>
+                        <td>{{ activeImport.rows_skipped }}</td>
+                    </tr>
+                    <tr>
+                        <td>Неизвестных статусов</td>
+                        <td>{{ activeImport.unknown_statuses_count }}</td>
+                    </tr>
+                </tbody>
+            </v-table>
+            <v-alert
+                v-if="activeImport.status === 'failed'"
+                type="error"
+                variant="tonal"
+                class="mt-3"
+            >
+                {{ activeImport.error_message }}
+            </v-alert>
+        </v-card>
+
+        <v-card variant="outlined" class="pa-6">
+            <h2 class="text-h6 mb-3">История импортов</h2>
+            <v-table v-if="history.length > 0" density="compact">
+                <thead>
+                    <tr>
+                        <th>Файл</th>
+                        <th>Статус</th>
+                        <th>Добавлено</th>
+                        <th>Обновлено</th>
+                        <th>Пропущено</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <tr v-for="row in history" :key="row.id">
+                        <td>{{ row.filename }}</td>
+                        <td>{{ row.status }}</td>
+                        <td>{{ row.rows_added }}</td>
+                        <td>{{ row.rows_updated }}</td>
+                        <td>{{ row.rows_skipped }}</td>
+                    </tr>
+                </tbody>
+            </v-table>
+            <p v-else class="text-body-2 text-medium-emphasis ma-0">Импортов пока нет.</p>
+        </v-card>
+
+        <UnknownStatusesDialog
+            v-model="wizardOpen"
+            :statuses="unknownStatuses"
+            @resolved="onWizardResolved"
+        />
+    </v-container>
+</template>
+
+<style scoped>
+.import-view {
+    max-width: 1100px;
+}
+</style>

app/resources/js/views/KanbanView.vue

@@ -5,13 +5,16 @@
  * Источник дизайна: liderra_v8_handoff/concepts/v8_kanban.html.
  * DnD реализован через vuedraggable@4 (обёртка SortableJS) — карточки можно
  * перетаскивать между колонками. При drop:
- *   - событие 'added' в целевой колонке → меняем `statusSlug` сделки.
+ *   - событие 'added' в целевой колонке → optimistic update statusSlug +
+ *     POST /api/deals/transition (через dealsApi). На failure — revert:
+ *     карточка возвращается в исходную колонку + toast «Не удалось переместить».
+ *     Без auth.user.tenant_id — local-only mode (API не зовётся).
  *   - событие 'removed' в исходной колонке → ничего не делаем (обработано в added).
  *   - событие 'moved' внутри одной колонки → только смена порядка (statusSlug
  *     не меняется; на API будущем — PATCH /api/deals/{id} {sort_order}).
  *
  * Не входит в этот коммит:
- * - PATCH /api/deals/{id} {status_slug} при drop — backend.
+ * - PATCH /api/deals/{id} {sort_order} при moved (intra-column reorder) — backend.
  * - Filters (Проект/Менеджер) — общий filter-bar с DealsView.
  * - DealDetailDrawer на click по карточке (event @open-deal).
  */
@@ -50,14 +53,44 @@ const dealsByStatus = reactive<Record<string, MockDeal[]>>(
     }, {}),
 );
 
-function onColumnChange(targetSlug: MockDeal['statusSlug'], event: DraggableChangeEvent) {
-    if (event.added) {
-        // Карточка переехала в эту колонку → синхронизируем statusSlug.
-        // На production будет POST /api/deals/{id}/transition с проверкой allowed-переходов.
-        event.added.element.statusSlug = targetSlug;
+async function onColumnChange(targetSlug: MockDeal['statusSlug'], event: DraggableChangeEvent) {
+    if (!event.added) {
+        // 'removed' и 'moved' — vuedraggable мутирует array; reactive triggers re-render.
+        return;
+    }
+
+    const dealItem = event.added.element;
+    const previousSlug = dealItem.statusSlug;
+
+    // Optimistic: меняем статус в local state сразу (UX отвечает мгновенно).
+    dealItem.statusSlug = targetSlug;
+
+    // Без auth — local-only mode (dev/demo без tenant context). API не зовём.
+    if (!auth.user?.tenant_id) return;
+
+    try {
+        await dealsApi.transitionDeals({
+            tenant_id: auth.user.tenant_id,
+            ids: [dealItem.id],
+            status: targetSlug,
+        });
+        // success — статус уже применён, тостить не нужно.
+    } catch {
+        // Revert на исходный статус + переместить карточку обратно в исходную колонку.
+        dealItem.statusSlug = previousSlug;
+        // Найдём целевую колонку и удалим из неё карточку, потом вернём в исходную.
+        const targetCol = dealsByStatus[targetSlug];
+        if (targetCol) {
+            const idx = targetCol.findIndex((d) => d.id === dealItem.id);
+            if (idx >= 0) targetCol.splice(idx, 1);
+        }
+        const sourceCol = dealsByStatus[previousSlug];
+        if (sourceCol && !sourceCol.find((d) => d.id === dealItem.id)) {
+            sourceCol.push(dealItem);
+        }
+        transitionToastText.value = `Не удалось переместить сделку #${dealItem.id} — восстановлен исходный статус.`;
+        transitionToastOpen.value = true;
     }
-    // 'removed' и 'moved' — обрабатываются автоматически через v-model
-    // (vuedraggable мутирует array; reactive triggers re-render).
 }
 
 const drawerOpen = ref(false);
@@ -80,6 +113,10 @@ const fetchError = ref(false);
 
 const newDealOpen = ref(false);
 
+// Sprint 1 C4: revert-on-fail toast при DnD-fail.
+const transitionToastOpen = ref(false);
+const transitionToastText = ref('');
+
 function onDealCreated(deal: MockDeal) {
     if (!dealsByStatus[deal.statusSlug]) dealsByStatus[deal.statusSlug] = [];
     dealsByStatus[deal.statusSlug].unshift(deal);
@@ -113,7 +150,17 @@ onMounted(() => {
 
 usePolling(loadDeals);
 
-defineExpose({ dealsByStatus, totalDeals, newDealOpen, onDealCreated, fetchError, loadDeals });
+defineExpose({
+    dealsByStatus,
+    totalDeals,
+    newDealOpen,
+    onDealCreated,
+    fetchError,
+    loadDeals,
+    onColumnChange,
+    transitionToastOpen,
+    transitionToastText,
+});
 </script>
 
 <template>
@@ -176,6 +223,16 @@ defineExpose({ dealsByStatus, totalDeals, newDealOpen, onDealCreated, fetchError
         <DealDetailDrawer v-model:open="drawerOpen" :deal="selectedDeal" :tenant-id="auth.user?.tenant_id" />
 
         <NewDealDialog v-model="newDealOpen" :tenant-id="auth.user?.tenant_id" @created="onDealCreated" />
+
+        <v-snackbar
+            v-model="transitionToastOpen"
+            :timeout="4000"
+            color="warning"
+            location="bottom right"
+            data-testid="kanban-transition-toast"
+        >
+            {{ transitionToastText }}
+        </v-snackbar>
     </v-container>
 </template>