Adds application design (awaiting approval)

aidlc-docs/_shared/reverse-engineering/api-documentation.md

@@ -10,15 +10,16 @@
 - **Purpose**: Authenticate a user and receive JWT tokens
 - **Authorization**: Anonymous
 - **Request**: `{ "email": string, "password": string }`
-- **Response**: `{ "accessToken": string, "refreshToken": string, "expiresAt": datetime, "user": { "id": guid, "email": string, "naam": string, "role": string } }`
+- **Response**: `{ "accessToken": string, "expiresAt": datetime, "user": { "id": guid, "email": string, "name": string, "role": string, "isActive": bool } }`
+- **Cookie set**: `refreshToken` (httpOnly, Secure, SameSite=Strict, Path=/api/v1/auth)
 
 #### POST /auth/refresh
 - **Method**: POST
 - **Path**: `/auth/refresh`
-- **Purpose**: Refresh an access token using a valid refresh token
+- **Purpose**: Refresh an access token using the httpOnly refresh token cookie
 - **Authorization**: Anonymous
-- **Request**: `{ "accessToken": string, "refreshToken": string }`
-- **Response**: Same as `/auth/login`
+- **Request**: (empty body — refresh token read from cookie)
+- **Response**: Same as `/auth/login` (new access token + new cookie)
 
 #### POST /auth/revoke
 - **Method**: POST
@@ -110,10 +111,18 @@
 - `expiresAt` — access token expiry datetime
 - `user` — authenticated user info
 
+### Password Validation Rules (enforced by backend)
+Configured in `ServiceCollectionExtensions.cs` via ASP.NET Core Identity `PasswordOptions`:
+- `RequiredLength = 8` — minimum 8 characters
+- `RequireUppercase = true` — at least 1 uppercase letter
+- `RequireLowercase = true` — at least 1 lowercase letter
+- `RequireDigit = true` — at least 1 digit
+- `RequireNonAlphanumeric = true` — at least 1 non-alphanumeric character (e.g. `!@#$%^&*`)
+
 ### ApplicationUser (returned in auth responses)
 - `id` — Guid
 - `email` — string
-- `naam` — string (display name)
+- `name` — string (display name)
 - `role` — string (Owner / Admin / User)
 - `isActive` — boolean