Plans the Gitea deployment feature and refreshes the codebase analysis

Adds the AI-DLC inception record for deploying the CMS as a single .NET
application on hosting where no server configuration is possible.

The reverse-engineering artifacts were regenerated: the previous set
predated the Master module, the Slave host, the solution reorganisation
and single-host serving, all of which matter for deployment. Findings
were verified by running the build, both test suites and the linter
rather than inferred, which surfaced two facts the plan depends on:
the frontend lint gate currently fails (5 errors), and two transitive
packages carry high-severity advisories.

Records 24 functional requirements, 32 traced decisions and a
seven-unit decomposition whose ordering is load-bearing: durability
work must land before the first automated deploy, or the very first
deploy is the one that silently breaks master/slave trust.

Two conflicts found while designing and carried into the units:
- Both modules call AddDataProtection(), which runs after the host and
  would override a persistent key store while still passing any
  registration test.
- The availability gate runs before authentication, so its admin
  bypass cannot read HttpContext.User.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HHoJpxYXzHACSQguHrC5fw

aidlc-docs/_shared/reverse-engineering/technology-stack.md

@@ -1,56 +1,80 @@
-# Technology Stack
+# Technology Stack
 
 ## Backend
 
 ### Programming Languages
-- C# 14.0 — All backend packages
+- C# (latest for `net10.0`) — all backend projects. `Nullable` and `ImplicitUsings` enabled everywhere.
 
 ### Frameworks
-- ASP.NET Core 10.0 — Web API framework
-- ASP.NET Core Identity — User/role management, password hashing
-- Entity Framework Core 10.0 — ORM for SQL Server persistence
+- .NET / ASP.NET Core `net10.0` — host, MVC controllers, middleware pipeline, static-file serving with SPA fallbacks. SDK observed: **10.0.301**.
+- ASP.NET Core Identity (`Microsoft.AspNetCore.Identity.EntityFrameworkCore` 10.0.9) — users, roles, password hashing and policy.
+- Entity Framework Core (`Microsoft.EntityFrameworkCore.SqlServer` 10.0.9, `…Design` 10.0.9) — three `DbContext` types over one connection string.
+- `Microsoft.AspNetCore.Authentication.JwtBearer` 10.0.9 — bearer token validation, `ClockSkew.Zero`.
+- `Asp.Versioning.Mvc` 10.0.0 — API version reporting alongside the static `/api/v1` prefix convention.
+- `Microsoft.AspNetCore.OpenApi` 10.0.9 + `Scalar.AspNetCore` 2.16.3 — OpenAPI document and `/scalar` reference UI, **Development only**.
+- `Microsoft.Extensions.Http.Resilience` 9.6.0 (with Polly) — retry/timeout pipeline for master→slave HTTP calls. Note: a 9.x package on a `net10.0` target.
+- ASP.NET Core Data Protection (shared framework) — encrypts slave API keys. Default file-system key ring; **no persistent key store configured**.
+- Built-in rate limiting (`Microsoft.AspNetCore.RateLimiting`) — fixed-window `login`, sliding-window `refresh`.
 
 ### Infrastructure
-- SQL Server — Primary database
-- JWT Bearer Authentication — Stateless auth with refresh tokens
+- SQL Server — one database per instance. Local development via a container (`mcr.microsoft.com/mssql/server:2022-latest`) or LocalDB.
+- No cloud services, message broker, cache server or container orchestration is used.
+- Deployment target: shared hosting (e.g. mijnhostingpartner.nl) with a single site/application pool and **no server configuration**. The web SDK generates `web.config` on publish for IIS-based hosting.
 
 ### Build Tools
-- .NET 10 SDK / dotnet CLI — Build, test, publish
-- MSBuild — Underlying build engine
+- .NET SDK 10 / `dotnet` CLI — build, test, publish.
+- MSBuild — including the custom `BuildAndCopyAdminFrontend` target in `SlpModularCms.Api.csproj`, which makes **Node and pnpm hard prerequisites of `dotnet publish`**.
+- `dotnet ef` — migration authoring; per-module contexts need `--context` disambiguation (`AvailabilityDbContext`).
 
 ### Testing Tools
-- xUnit (inferred from project conventions) — Unit testing framework
-- Moq or similar (inferred) — Mocking in unit tests
+- xUnit 2.9.3 with `xunit.runner.visualstudio` 3.1.4 and `Microsoft.NET.Test.Sdk` 17.14.1.
+- FluentAssertions 8.10.0 — assertions.
+- NSubstitute 5.3.0 — mocking.
+- AutoFixture 4.18.1 — test data.
+- `Microsoft.EntityFrameworkCore.InMemory` 10.0.9 — in-memory persistence for tests.
+- coverlet 6.0.4 (`coverlet.collector`) with `coverlet.runsettings` at the repository root.
 
----
-
-## Frontend (Example App — ZIP file basis)
+## Frontend (admin SPA, `frontend/`)
 
 ### Programming Languages
-- TypeScript — All frontend code
+- TypeScript `~6.0.2` — all frontend code.
 
-### Frameworks
-- React 18.3.1 — UI framework
-- TanStack Router — Client-side routing (replaces React Router v7 from example app; chosen for full TypeScript safety and modern routing features)
-- Tailwind CSS v4 (4.1.12) — Utility-first CSS framework
-- shadcn/ui (via Radix UI) — Accessible component primitives
-
-### UI Component Libraries
-- Radix UI — Headless component primitives (accordion, dialog, dropdown, etc.)
-- lucide-react (0.487.0) — SVG icon library
-- recharts (2.15.2) — Charts and data visualization
-- MUI / Material UI (7.3.5) — Additional UI components
-
-### State / Data
-- react-hook-form (7.55.0) — Form state management
-- sonner (2.0.3) — Toast notifications
-- next-themes (0.4.6) — Dark/light theme support
+### Frameworks and Libraries
+- React 19.2 + React DOM 19.2.
+- Vite 8.0 with `@vitejs/plugin-react` 6 — build and dev server. `base: '/admin/'` on build only.
+- TanStack Router 1.170 — routing, `basepath: import.meta.env.BASE_URL` so it follows the `/admin/` base.
+- TanStack React Query 5.101 — server state.
+- Tailwind CSS 4.3 via `@tailwindcss/vite` — styling.
+- Radix UI primitives (dialog, dropdown-menu, label, select, slot) with shadcn-style wrappers; `class-variance-authority`, `clsx`, `tailwind-merge`.
+- `lucide-react` 1.21 — icons. `sonner` 2.0 — toasts.
+- `react-hook-form` 7.79 with `@hookform/resolvers` 5.4 and `zod` 4.4 — forms and validation. Zod also validates app config.
+- `i18next` 26 / `react-i18next` 17 / `i18next-browser-languagedetector` 8 — NL/EN.
 
 ### Build Tools
-- Vite 6.3.5 — Build tool and dev server
-- pnpm — Package manager (pnpm-workspace.yaml present)
-- PostCSS — CSS processing
+- pnpm — package manager. Observed locally: pnpm 10.33.2, Node v22.15.1. (The README states Node 20+ and pnpm 9+ as the requirement.)
+- `tsc -b` runs before `vite build`, so type errors fail the build.
 
-### Theme
-- Primary color: `#ac0000` (deep red)
-- Mode: Light + dark via CSS custom properties
+### Testing Tools
+- Vitest 4.1 with `@vitest/coverage-v8` and jsdom 29.
+- Testing Library: `@testing-library/react` 16.3, `jest-dom` 6.9, `user-event` 14.6.
+- MSW 2.14 — request mocking in tests, and optionally in the browser via `VITE_ENABLE_MSW=true`.
+
+### Linting and Formatting
+- ESLint 10 with `typescript-eslint` 8.59, `eslint-plugin-react-hooks` 7, `eslint-plugin-react-refresh` 0.5.
+- Prettier 3.8 (`format`, `format:check` scripts, 4-space indent).
+- No linter or analyzer configuration exists for the backend beyond compiler nullable warnings.
+
+## Observability
+
+**Not implemented.** The stack currently has:
+- Logging: default ASP.NET Core console provider only, configured through `Logging:LogLevel` (`Warning` in the production baseline, `Information` in Development). No structured logging, no log sink, no correlation IDs.
+- Error tracking: none — no Sentry package on either side.
+- Analytics: none — no Umami script or equivalent.
+- Uptime/health: no health-check endpoint, no `MapHealthChecks`.
+- Metrics/tracing: no OpenTelemetry.
+
+The intended stack for this feature — **UptimeRobot** for uptime, **Umami** for analytics, **console logging plus Sentry** for logging and errors — is therefore entirely greenfield in this repository. A working reference implementation of the Umami and Sentry parts (for a React/Vite frontend) exists in `K:\Development\SlpSoftware\Projects\SlpSoftware`.
+
+## Environments
+
+Three environments are in scope: **local**, **test** and **production**. Configuration follows the three-file appsettings pattern (`appsettings.json`, `appsettings.Development.json`, gitignored `appsettings.local.json`), with production secrets supplied as environment variables using the `Section__Key` convention. There is currently no `appsettings.Test.json` or equivalent, and no `ASPNETCORE_ENVIRONMENT` value defined for a test environment.