Adds SlpModularCms.Api.SlpSoftware and extracts shared CmsHost composition

Unit 1 of the slpsoftware-api feature (FR-1/FR-2/FR-3): a new Client project
in the Clients solution folder, intended to eventually become the deployed
API for test.slpsoftware.nl/slpsoftware.nl, hosting the same four modules as
SlpModularCms.Api plus a future Offerings module.

- Extracts SlpModularCms.Api/Program.cs's hosting-pipeline composition into
  SlpModularCms.Core.Hosting.CmsHost (ConfigureServices/ConfigurePipeline),
  shared by both Client projects so they cannot drift apart
- Moves StaticContentExtensions.cs + WebsitePlaceholder.html from Api into
  Core, since CmsHost cannot live in Api but Core cannot depend on Api
- Adds SlpModularCms.Api.SlpSoftware with its own isolated local dev database
  and dev ports (5286/7223, distinct from Api's and Api.Slave's)
- Adds SlpModularCms.Api.Tests with WebApplicationFactory-based pipeline
  regression tests (security headers, health check, SPA fallback, rate
  limiting), scoped to Api per NFR Design
- Adds a frontend dev:slpsoftware pnpm script mirroring dev:slave
- Fixes GlobalExceptionHandler logging routine 401s (e.g. an expired/missing
  refresh token) as unhandled errors -- pre-existing, unrelated to this
  feature's own scope, found while testing the new instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN

aidlc-docs/features/slpsoftware-api/inception/application-design/unit-of-work-story-map.md

@@ -0,0 +1,44 @@
+# Unit of Work Story Map — SlpSoftware Production API
+
+## Unit 1: SlpSoftware Client Setup
+
+| User Story | Assigned? |
+|---|---|
+| — | None (decision Q3 = A — this unit is a purely technical enabling unit) |
+
+| Functional Requirement | Assigned |
+|---|---|
+| FR-1 (new Client project) | ✅ |
+| FR-2 (module composition) | ✅ |
+| FR-3 (shared hosting extraction) | ✅ |
+
+## Unit 2: Offerings
+
+| User Story | Assigned |
+|---|---|
+| US-01 — View the list of available offerings | ✅ |
+| US-02 — See the recommended offering highlighted | ✅ |
+| US-03 — Website stays functional with zero offerings | ✅ |
+| US-04 — Create a new offering | ✅ |
+| US-05 — Edit an existing offering | ✅ |
+| US-06 — Delete an offering | ✅ |
+| US-07 — Delete the last remaining offering | ✅ |
+| US-08 — Reorder offerings via drag-and-drop | ✅ |
+| US-09 — Reorder offerings via up/down buttons | ✅ |
+| US-10 — Mark an offering as featured (system-enforced exclusivity) | ✅ |
+| US-11 — Receive validation feedback on invalid input | ✅ |
+| US-12 — Admin actions require the Administrator role | ✅ |
+
+| Functional Requirement | Assigned |
+|---|---|
+| FR-4 (new module) | ✅ |
+| FR-5 (`Offering` entity) | ✅ |
+| FR-6 (public endpoint) | ✅ |
+| FR-7 (admin CRUD) | ✅ |
+| FR-8 (reference content, documentation only — no code) | ✅ |
+
+## Coverage Check
+
+- **All 12 user stories** assigned to exactly one unit (Offerings). ✅
+- **All 9 functional requirements** (FR-1 through FR-9) assigned, except **FR-9** (CI/CD retarget) — correctly **not** assigned to either Construction unit, since it belongs to the Operations phase, not Construction (per D-7/D-15 and the execution plan). ✅
+- No story or FR is assigned to more than one unit, and no story is left unassigned. ✅