Adds the Offerings module and retargets the CI/CD pipeline to Api.SlpSoftware

Implements Unit 2 "Offerings" (backend module, admin CRUD UI with
drag-and-drop reordering, public GET /api/v1/offerings endpoint) and
executes the feature's D-15 CI/CD cutover, switching the deploy
pipeline's build/publish target from SlpModularCms.Api to
SlpModularCms.Api.SlpSoftware.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN

src/SlpModularCms.Modules.Offerings/Controllers/OfferingsController.cs

@@ -0,0 +1,78 @@
+using System.Security.Claims;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using SlpModularCms.Modules.Offerings.Models;
+using SlpModularCms.Modules.Offerings.Services;
+
+namespace SlpModularCms.Modules.Offerings.Controllers;
+
+[ApiController]
+[Route("offerings")]
+[Authorize(Policy = "AdminOnly")]
+public class OfferingsController(IOfferingsService service) : ControllerBase
+{
+    [HttpGet]
+    [AllowAnonymous]
+    [EnableRateLimiting("offerings-public")]
+    public async Task<IActionResult> GetOfferings()
+    {
+        var offerings = await service.GetPublicOfferingsAsync();
+        return Ok(offerings);
+    }
+
+    [HttpGet("admin")]
+    public async Task<IActionResult> GetAllForAdmin()
+    {
+        var offerings = await service.GetAllForAdminAsync();
+        return Ok(offerings);
+    }
+
+    [HttpPost("admin")]
+    public async Task<IActionResult> Create([FromBody] CreateOfferingRequest request)
+    {
+        var dto = await service.CreateAsync(request, GetCallerId());
+        return CreatedAtAction(nameof(GetAllForAdmin), null, dto);
+    }
+
+    [HttpPut("admin/{id:guid}")]
+    public async Task<IActionResult> Update(Guid id, [FromBody] UpdateOfferingRequest request)
+    {
+        var dto = await service.UpdateAsync(id, request, GetCallerId());
+        return dto is null ? NotFound() : Ok(dto);
+    }
+
+    [HttpDelete("admin/{id:guid}")]
+    public async Task<IActionResult> Delete(Guid id)
+    {
+        var deleted = await service.DeleteAsync(id, GetCallerId());
+        return deleted ? NoContent() : NotFound();
+    }
+
+    [HttpPut("admin/reorder")]
+    public async Task<IActionResult> Reorder([FromBody] ReorderOfferingsRequest request)
+    {
+        await service.ReorderAsync(request.OrderedIds, GetCallerId());
+        return NoContent();
+    }
+
+    [HttpPost("admin/{id:guid}/move-up")]
+    public async Task<IActionResult> MoveUp(Guid id)
+    {
+        await service.MoveUpAsync(id, GetCallerId());
+        return NoContent();
+    }
+
+    [HttpPost("admin/{id:guid}/move-down")]
+    public async Task<IActionResult> MoveDown(Guid id)
+    {
+        await service.MoveDownAsync(id, GetCallerId());
+        return NoContent();
+    }
+
+    private Guid GetCallerId()
+    {
+        var claim = User.FindFirstValue(ClaimTypes.NameIdentifier) ?? User.FindFirstValue("sub");
+        return Guid.TryParse(claim, out var id) ? id : Guid.Empty;
+    }
+}