fix(admin): add admin.bookings.ktp-photo route and controller action

spk_kontrakan/app/Http/Controllers/BookingController.php

@@ -300,6 +300,44 @@ public function paymentProof(Booking $booking)
         ]);
     }
 
+    /**
+     * Stream KTP photo securely for admin (NOT public storage link).
+     */
+    public function ktpPhoto(Booking $booking)
+    {
+        // ========== AUTHORIZATION: Cek apakah admin punya akses ke booking ini ==========
+        $admin = auth()->guard('admin')->user();
+        if ($admin) {
+            if ($booking->kontrakan->admin_id !== $admin->id) {
+                abort(403, 'Anda tidak memiliki akses ke booking ini.');
+            }
+        }
+
+        if (!$booking->ktp_photo) {
+            abort(404, 'Foto KTP tidak tersedia.');
+        }
+
+        $path = $booking->ktp_photo;
+
+        // Mendukung disk private (secure) dan public sebagai fallback
+        $disk = self::PAYMENT_PROOF_PRIVATE_DISK;
+        if (!Storage::disk($disk)->exists($path)) {
+            if (Storage::disk(self::PAYMENT_PROOF_PUBLIC_DISK)->exists($path)) {
+                $disk = self::PAYMENT_PROOF_PUBLIC_DISK;
+            } else {
+                abort(404, 'File foto KTP tidak ditemukan.');
+            }
+        }
+
+        $absolutePath = Storage::disk($disk)->path($path);
+
+        return response()->file($absolutePath, [
+            'Content-Disposition' => 'inline; filename="ktp-photo-' . $booking->id . '"',
+            'Cache-Control' => 'no-store, no-cache, must-revalidate, max-age=0',
+            'Pragma' => 'no-cache',
+        ]);
+    }
+
     /**
      * Tampilkan form edit booking
      */

spk_kontrakan/app/Models/Booking.php

@@ -66,6 +66,8 @@ public static function syncKontrakanStatus($kontrakanId)
         'payment_status',
         'payment_method',
         'payment_proof',
+        'ktp_photo',
+        'jenis_pengajuan',
         'paid_at',
         'notes',
         'booking_source',

spk_kontrakan/app/Providers/AppServiceProvider.php

@@ -6,6 +6,8 @@
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
+use Illuminate\Auth\Notifications\VerifyEmail;
+use Illuminate\Notifications\Messages\MailMessage;
 
 class AppServiceProvider extends ServiceProvider
 {
@@ -84,5 +86,16 @@ public function boot(): void
                 $request->user()?->id ?: $request->ip()
             );
         });
+
+        // Kustomisasi Email Verifikasi Berbahasa Indonesia
+        VerifyEmail::toMailUsing(function (object $notifiable, string $url) {
+            return (new MailMessage)
+                ->subject('Verifikasi Alamat Email - Kontrak Kampus')
+                ->greeting('Halo, ' . $notifiable->name . '!')
+                ->line('Silakan klik tombol di bawah ini untuk memverifikasi alamat email akun Kontrak Kampus Anda.')
+                ->action('Verifikasi Email', $url)
+                ->line('Jika Anda tidak merasa mendaftar akun di aplikasi kami, Anda dapat mengabaikan email ini.')
+                ->salutation('Salam Hangat, \nTim Kontrak Kampus');
+        });
     }
 }

spk_kontrakan/resources/views/admin/bookings/index.blade.php

@@ -194,6 +194,11 @@
                                     <i class="bi bi-image"></i>
                                 </a>
                                 @endif
+                                @if($booking->jenis_pengajuan === 'sewa' && $booking->ktp_photo)
+                                <a href="{{ route('admin.bookings.ktp-photo', $booking->id) }}" target="_blank" class="btn btn-sm btn-outline-primary ms-1" title="Lihat Foto KTP">
+                                    <i class="bi bi-person-vcard"></i>
+                                </a>
+                                @endif
                                 @if($booking->booking_source == 'user')
                                 <span class="badge bg-info ms-1" title="Booking dari User">
                                     <i class="bi bi-person"></i>

spk_kontrakan/routes/web.php

@@ -133,6 +133,8 @@
         Route::get('/{booking}', [BookingController::class, 'show'])->name('show');
         // ✅ Secure payment proof view (not public storage link)
         Route::get('/{booking}/payment-proof', [BookingController::class, 'paymentProof'])->name('payment-proof');
+        // ✅ Secure KTP photo view
+        Route::get('/{booking}/ktp-photo', [BookingController::class, 'ktpPhoto'])->name('ktp-photo');
         Route::get('/{booking}/edit', [BookingController::class, 'edit'])->name('edit');
         Route::put('/{booking}', [BookingController::class, 'update'])->name('update');
         Route::delete('/{booking}', [BookingController::class, 'destroy'])->name('destroy');