Adds SlpModularCms.Api.SlpSoftware and extracts shared CmsHost composition

Unit 1 of the slpsoftware-api feature (FR-1/FR-2/FR-3): a new Client project
in the Clients solution folder, intended to eventually become the deployed
API for test.slpsoftware.nl/slpsoftware.nl, hosting the same four modules as
SlpModularCms.Api plus a future Offerings module.

- Extracts SlpModularCms.Api/Program.cs's hosting-pipeline composition into
  SlpModularCms.Core.Hosting.CmsHost (ConfigureServices/ConfigurePipeline),
  shared by both Client projects so they cannot drift apart
- Moves StaticContentExtensions.cs + WebsitePlaceholder.html from Api into
  Core, since CmsHost cannot live in Api but Core cannot depend on Api
- Adds SlpModularCms.Api.SlpSoftware with its own isolated local dev database
  and dev ports (5286/7223, distinct from Api's and Api.Slave's)
- Adds SlpModularCms.Api.Tests with WebApplicationFactory-based pipeline
  regression tests (security headers, health check, SPA fallback, rate
  limiting), scoped to Api per NFR Design
- Adds a frontend dev:slpsoftware pnpm script mirroring dev:slave
- Fixes GlobalExceptionHandler logging routine 401s (e.g. an expired/missing
  refresh token) as unhandled errors -- pre-existing, unrelated to this
  feature's own scope, found while testing the new instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN

aidlc-docs/features/slpsoftware-api/inception/user-stories/personas.md

@@ -0,0 +1,28 @@
+# Personas — SlpSoftware Production API
+
+## Persona 1: Site Visitor
+
+| Attribute | Description |
+|---|---|
+| **Role** | Anonymous visitor of the public website (`test.slpsoftware.nl` / `slpsoftware.nl`) |
+| **Access Level** | None — unauthenticated, public |
+| **Goal** | Understand what services/packages are on offer, their price and what's included, so they can decide which one fits their needs and get in touch. |
+| **Pain Points** | A broken or empty "Drie manieren om te starten" section erodes trust before the visitor even reaches the contact form. |
+| **Technical Context** | Interacts only through the existing React frontend (external, read-only reference workspace) — never calls the API directly. All API behavior is experienced indirectly through what the frontend renders. |
+| **Relationship to this feature** | Consumes `GET /api/v1/offerings` (FR-6) indirectly. Never touches the admin CRUD (FR-7). |
+
+## Persona 2: CMS Administrator
+
+| Attribute | Description |
+|---|---|
+| **Role** | Authenticated user holding the `Administrator` role (or higher — `Owner`, per the existing role hierarchy) |
+| **Access Level** | `AdminOnly` policy — full CRUD access to offerings via the admin SPA under `/admin` |
+| **Goal** | Keep the list of offerings shown on the website accurate and up to date (pricing, features, copy) without needing a code deploy, and control which one is highlighted as "most chosen". |
+| **Pain Points** | Today this content is hardcoded in the frontend's `content.ts` — any change requires a frontend deploy. This feature removes that dependency. |
+| **Technical Context** | Uses the existing admin SPA (already served under `/admin` by the same Client API, per the shared hosting pipeline). Not a developer — needs a UI, not direct API/database access. |
+| **UI Language Note** | The existing admin SPA already ships with `nl`/`en` i18n locales (`frontend/src/i18n/locales/`), where the `Administrator` role is already labeled `"Beheerder"` in Dutch. This persona's documentation name ("CMS Administrator") is the English documentation term; the on-screen label the persona actually sees follows the existing i18n setup and needs no new translation work. |
+| **Relationship to this feature** | Sole user of the new admin CRUD (FR-7): create, edit, delete, reorder offerings, and control the `featured` flag. |
+
+---
+
+**2 personas**, matching the two distinct access levels established in requirements.md (public/anonymous vs. `AdminOnly`).