feat: omnichannel contactmoment registration (#234)

[rubenvdlinde]

Closes #234

Summary

Implements omnichannel contact registration enabling KCC agents to register interactions from any channel (phone, email, counter, chat, social media, letter). Adds contactmoment entity with channel-specific metadata, adaptive form based on channel selection, call timer for phone contacts, and filterable contact moment list with search and CSV export.

Spec Reference

• Issue: Implement: Omnichannel Registratie #234
• Spec: openspec/changes/2026-03-20-omnichannel-registratie/design.md

Changes

• lib/Settings/pipelinq_register.json — Added contactmoment schema with VNG Klantinteracties alignment
• src/views/contactmomenten/ContactmomentList.vue — Filterable list with channel icons, search, CSV export
• src/views/contactmomenten/ContactmomentForm.vue — Adaptive form based on channel selection
• src/views/contactmomenten/ContactmomentDetail.vue — Full detail view with linked entities
• src/components/CallTimer.vue — MM:SS timer component for phone call duration tracking
• src/router/index.js — Added contactmomenten routes (/contactmomenten, /contactmomenten/new, /contactmomenten/:id)
• src/navigation/MainMenu.vue — Added Contact Moments navigation entry

Test Coverage

• npm run build completes successfully without errors (webpack 5.105.2 compiled)
• All Vue components integrated and route mappings verified

[github-actions]

Quality Report — ConductionNL/pipelinq @ 0583db6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 100/100
npm			✅	✅ 249/249
PHPUnit					⏭️
Newman					⏭️
Playwright					❌

Spec coverage: 14% (42 tests / 298 specs)

---

Quality workflow — 2026-04-20 20:44 UTC

Download the full PDF report from the workflow artifacts.

[rubenvdlinde]

Security Review — Clyde Barcode

Result: PASS (0 fixed, 0 unfixed, 0 blocking)

Scope

3 changed files reviewed: design.md, hydra.json, tasks.md — all are OpenSpec documentation files (Markdown + JSON). No PHP or Vue source code in this diff.

Checks Run

Check	Result
semgrep p/security-audit + p/secrets + p/owasp-top-ten	✅ 0 findings (44 rules, 3 files)
gitleaks detect --no-git	✅ No leaks found
composer audit	✅ No packages flagged
npm audit --production	⚠️ Drift signal (see below)
Manual OWASP Top 10 diff review	✅ No issues in changed files

Drift Signal — npm audit

The pre-run quality stage reported npm-audit: PASS. My independent run found 16 pre-existing vulnerabilities (9 low, 5 moderate, 2 high) in transitive dependencies — notably fast-xml-parser (HIGH, stack overflow / entity expansion, GHSA-fj3w-jwp8-x2g3) and minimatch (HIGH) via webdav. These are not introduced by this PR and the changed files contain no package.json / package-lock.json changes. The drift is likely a CVE database update between the pre-run and this review. Flagging for tracking; a dedicated dependency-update issue is recommended.

Summary

• Total findings: 0
• Fixed: 0
• Unfixed: 0
• Verdict: pass

No inline comments posted — no per-file findings to annotate.