ARCH-001 Phase 28: consolidate Admin/Store/Vendor HomeController infra actions

[KrzysztofPajak]

ARCH-001 Phase 28: HomeController infra actions

First infra-action consolidation in this initiative (not a domain entity):
GetStatesByCountryId, Logout, and SetLanguage were duplicated across
HomeController in 2 or 3 of the 3 hosts, each differing only in one small
parameterizable string.

What was actually duplicated (read all 3 originals first, not assumed)

• SetLanguage: Admin+Store only — Vendor never had this action (confirmed
  by reading Grand.Web.Vendor/Controllers/HomeController.cs directly, not by
  trusting an earlier grep). Putting it on a base Vendor also extends would have
  silently added a brand-new route to Vendor (MVC discovers every public action
  across the whole inheritance chain) — so it lives on a second-level base,
  BaseHomeControllerWithSetLanguage : BaseHomeController, used only by
  Admin/Store. Vendor extends the plain BaseHomeController directly. Same
  two-level split BaseOrderController/BaseOrderManagementController already
  established for Order's Vendor-is-a-subset shape.
• GetStatesByCountryId's SelectState resource key: Admin and Store use the
  identical literal "Admin.Address.SelectState" — not "Store.Address.SelectState",
  which would be the naming-pattern guess from elsewhere in this initiative.
  Verified by reading Admin's own method (the earlier survey only diffed
  Store vs. Vendor). Only Vendor differs ("Vendor.Address.SelectState").
  Parameterized via an abstract SelectStateResourceKey property.
• The empty-countryId-branch key ("Address.SelectState", no host prefix) is
  byte-identical across all 3 hosts — left as a shared literal, not parameterized.
• The addSelectStateItem/result.Any() check-order difference between
  Admin/Store (nested if) and Vendor (combined &&) is confirmed cosmetic,
  not behavioral — logically equivalent for every input.
• Logout's route name ("AdminLogin"/"StoreLogin"/"VendorLogin") is the
  one genuinely 3-way difference, parameterized via LogoutRouteName.

DashboardActivity/ChangeStore (Admin-only) and Index/Statistics/
AccessDenied (real per-host views) stay untouched on each concrete controller.

Found, explicitly out of scope

AccessDenied() is also byte-identical across all 3 hosts — missed by the
earlier repo-wide survey because its method-name search only matched async
Task<IActionResult> signatures, and AccessDenied is synchronous
(IActionResult). Flagged for a future micro-phase rather than folded into this
one's diff.

Tests

No prior coverage existed for any of the 3 originals. Added:

• BaseHomeControllerTests — parameterization proven via two differently-configured
  test subclasses (not just one), covering GetStatesByCountryId's 4 branches,
  Logout, and SetLanguage's both redirect paths.
• HomeControllerAttributeTests (Admin + Store).
• HomeControllerSurfaceTests (Vendor) — asserts Vendor's HomeController does
  not declare SetLanguage, the exact regression the two-level-base design
  exists to prevent.

Verification

dotnet build GrandNode.sln — 0 errors. Per-project test runs (parallel
full-solution runs are known-flaky):

• Grand.Web.Admin.Tests: 1440/1440
• Grand.Web.Store.Tests: 142/142
• Grand.Web.Vendor.Tests: 27/27

No live smoke test run this phase — deferred, disclosed here rather than silently
skipped: pure infra plumbing (language switch, logout, states dropdown), no
cross-tenant/access-control surface, same justification class as Phase 24/25.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.