docs: record profile settings parity completion

docs/CHATWOOT_PARITY_DEVELOPMENT_PLAN.md

@@ -16,7 +16,7 @@ Build GoChat as a Go backend that can directly reuse the frontend from `referenc
 
 ## Current Baseline
 
-- Latest implementation checkpoint: `e59f9f3 feat(auth): add chatwoot session routes`.
+- Latest implementation checkpoint: `7aa3362 feat(profile): support chatwoot settings updates`.
 - Worktree status at this planning checkpoint: clean.
 - `go test ./...` passes.
 - Route dump succeeds with `TOTAL: 805` after Chatwoot root auth/session routes were added.
@@ -70,18 +70,19 @@ This ledger records the committed parity checkpoints that future slices should b
 | `ebd8f08 feat(webhook): finalize provider ingress parity` | Finalized P6.7 provider classification with Twitter CRC prefix parity, Twitter route-level webhook tests, Instagram missing-signature rejection coverage, and Shopify real-handler classification. | Focused webhook/API tests passed; full `go test ./...` passed. | Move next to serializer/API parity queue. |
 | `56a8c5b feat(profile): align chatwoot user serializer` | Aligned `/api/v1/profile`, profile update, avatar delete/update, availability, auto-offline, and reset-access-token responses to Chatwoot's raw `api/v1/models/_user.json.jbuilder` shape. Added user/account/account_user fields and personal access-token persistence needed by the serializer. | Focused profile/API tests passed; sandboxed `go test ./...` hit socket restrictions; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with `/auth/sign_in`, `/auth/validate_token`, auth headers/cookie contract, and current-user payload fixtures. |
 | `e59f9f3 feat(auth): add chatwoot session routes` | Added root `/auth/sign_in`, `/auth/validate_token`, `/auth/sign_out`, and `/auth/password` routes consumed by the reused Chatwoot frontend. Sign-in now emits DeviseTokenAuth-compatible `access-token`, `token-type`, `client`, `expiry`, and `uid` headers and returns raw `{ data: user }`; validate-token returns `{ payload: { success, data } }`. | Focused auth/profile tests passed; route dump regenerated with `TOTAL: 805`; route parity remained `251 exact, 0 missing`; escalated full `go test ./...` passed; `git diff --check` passed. | Continue B2 with profile settings update parity: `display_name`, `message_signature`, `ui_settings`, password update, and multipart avatar handling. |
+| `7aa3362 feat(profile): support chatwoot settings updates` | Completed profile settings update parity for `display_name`, `message_signature`, `ui_settings`, `phone_number` custom attributes, password changes with current-password verification, and multipart `profile[...]` FormData including avatar file input. | Focused profile tests passed; escalated full `go test ./...` passed; `git diff --check` passed. | B2 core auth/profile fixtures are complete enough to move next to conversations/messages serializer parity. |
 
 ## Next Slice Contract
 
 Completed implementation slice: B2 profile-side serializer parity now returns the Chatwoot raw user payload for profile reads and mutations.
 
-Next implementation slice: continue Q4/B2 profile settings serializer parity, then move to conversations/messages.
+Next implementation slice: move to Q4/B3 conversations/messages serializer and behavior fixtures.
 
 | Step | Required result | Reference source | Verification |
 | --- | --- | --- | --- |
-| N1 | Complete profile settings update parity for `display_name`, `message_signature`, `ui_settings`, password update, and frontend multipart profile form handling. | `reference/chatwoot/app/controllers/api/v1/profiles_controller.rb`, frontend `api/auth.js`. | Handler tests assert persisted settings and raw user serializer response. |
-| N2 | Preserve auth/session route aliases and response fixtures for `/auth/sign_in`, `/auth/sign_out`, `/auth/validate_token`, and password routes used by the reused frontend. | `reference/chatwoot/app/controllers/devise_overrides/*`, `reference/chatwoot/app/views/devise/_auth.json.jbuilder`, frontend `api/auth.js`. | Existing auth fixture tests remain green. |
-| N3 | Move next serializer fixtures to conversations/messages after profile settings is compatible with the frontend store contract. | Chatwoot conversation/message Jbuilder views and frontend stores. | Fixture tests for list/show/create/status/assignment payloads. |
+| N1 | Add conversation/message serializer fixtures for list/show/create payloads used by the reused dashboard. | Chatwoot conversation/message controllers, Jbuilder views/entities, frontend conversation/message stores. | Fixture tests assert payload shape, meta fields, sender/assignee/contact/inbox nesting, and message arrays. |
+| N2 | Cover core conversation mutations: status, priority, assignment, labels, private notes, outgoing messages, attachments shell. | Chatwoot conversation/message controllers and jobs. | Handler/service tests assert status codes, persistence, and raw response shape. |
+| N3 | Preserve completed auth/profile fixtures while expanding the serializer suite. | Profile/auth tests and frontend auth client. | Existing auth/profile focused tests remain green. |
 | N4 | Regenerate route artifacts only if routes change; otherwise preserve `TOTAL: 801` and tracked route zero-missing status. | `cmd/dump_routes`, `cmd/route_parity`. | Route commands run when applicable. |
 | N5 | Update this tracker after every implementation checkpoint. | This document. | `git diff --check`; `go test ./...` for Go changes. |
 
@@ -93,6 +94,7 @@ Current B2 profile checkpoint:
 - User creation now assigns a `pubsub_token` like Chatwoot's `Pubsubable` concern, avoiding duplicate empty token rows and enabling ActionCable-compatible profile payloads.
 - Added migration `000017_add_profile_serializer_fields` for profile serializer fields on users, accounts, and account_users.
 - Added Chatwoot root auth/session routes. `/auth/sign_in` now accepts normalized email/password login, emits the auth headers stored by frontend `cw_d_session_info`, and returns the profile serializer under `data`. `/auth/validate_token` validates the same `access-token` header and returns the frontend-expected `payload.data` shape. `/auth/sign_out` revokes the refresh session.
+- Added profile settings update support for JSON and multipart form payloads produced by `dashboard/api/auth.js`: `profile[display_name]`, `profile[message_signature]`, `profile[avatar]`, JSON `profile.ui_settings`, `profile.phone_number`, and password update fields now persist and return the raw Chatwoot user serializer.
 
 ## Immediate Execution Queue
 
@@ -143,7 +145,7 @@ Work proceeds top-down unless a failing test or frontend blocker forces a narrow
 | Slice | Work | Reference source | Verification | Status |
 | --- | --- | --- | --- | --- |
 | B1 | Webhook ingress route and handler parity. | `reference/chatwoot/config/routes.rb:614-624`, `reference/chatwoot/app/controllers/webhooks/*`, `reference/chatwoot/app/controllers/api/v1/webhooks_controller.rb` | Provider lookup tests, router route dump, `go test ./...`. | Done |
-| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Doing: profile serializer and auth/session fixtures done; profile settings/password/multipart avatar remain. |
+| B2 | Auth/profile serializer fixtures. | `reference/chatwoot/app/controllers/api/v1/profile*`, frontend auth client. | Fixture tests for login/current user/profile/availability/settings. | Done |
 | B3 | Conversation/message serializer and behavior fixtures. | Chatwoot conversation/message controllers, entities, jobs. | Fixture tests for list/show/create/update/private notes/attachments/status/assignment. | Todo |
 | B4 | Contact/company behavior fixtures. | Chatwoot contact/company controllers, merge/import/export/notes/labels. | Fixture tests for CRUD/search/merge/relation/import-export shells. | Todo |
 | B5 | Inbox/channel behavior fixtures. | Chatwoot inbox/channel controllers and channel models. | Fixture tests for inbox CRUD, settings, business hours, members, avatar, channel config. | Todo |