Adds SlpModularCms.Api.SlpSoftware and extracts shared CmsHost composition

Unit 1 of the slpsoftware-api feature (FR-1/FR-2/FR-3): a new Client project
in the Clients solution folder, intended to eventually become the deployed
API for test.slpsoftware.nl/slpsoftware.nl, hosting the same four modules as
SlpModularCms.Api plus a future Offerings module.

- Extracts SlpModularCms.Api/Program.cs's hosting-pipeline composition into
  SlpModularCms.Core.Hosting.CmsHost (ConfigureServices/ConfigurePipeline),
  shared by both Client projects so they cannot drift apart
- Moves StaticContentExtensions.cs + WebsitePlaceholder.html from Api into
  Core, since CmsHost cannot live in Api but Core cannot depend on Api
- Adds SlpModularCms.Api.SlpSoftware with its own isolated local dev database
  and dev ports (5286/7223, distinct from Api's and Api.Slave's)
- Adds SlpModularCms.Api.Tests with WebApplicationFactory-based pipeline
  regression tests (security headers, health check, SPA fallback, rate
  limiting), scoped to Api per NFR Design
- Adds a frontend dev:slpsoftware pnpm script mirroring dev:slave
- Fixes GlobalExceptionHandler logging routine 401s (e.g. an expired/missing
  refresh token) as unhandled errors -- pre-existing, unrelated to this
  feature's own scope, found while testing the new instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FWyStNL2ZsjrS7FLd7xvvN

src/SlpModularCms.Api.SlpSoftware/Program.cs

@@ -0,0 +1,14 @@
+using SlpModularCms.Core.Hosting;
+
+var builder = WebApplication.CreateBuilder(args);
+
+// Load local developer overrides
+builder.Configuration.AddJsonFile("appsettings.local.json", optional: true, reloadOnChange: true);
+
+var orchestrator = CmsHost.ConfigureServices(builder, new CmsHostOptions());
+
+var app = builder.Build();
+
+CmsHost.ConfigurePipeline(app, orchestrator, new CmsHostOptions());
+
+app.Run();

src/SlpModularCms.Api.SlpSoftware/Properties/launchSettings.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:5286",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      },
+      "launchUrl": "scalar"
+    },
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "https://localhost:7223;http://localhost:5286",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      },
+      "launchUrl": "scalar"
+    }
+  }
+}

src/SlpModularCms.Api.SlpSoftware/SlpModularCms.Api.SlpSoftware.csproj

@@ -0,0 +1,34 @@
+<Project Sdk="Microsoft.NET.Sdk.Web">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Asp.Versioning.Mvc" Version="10.0.0" />
+        <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+        <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+        <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+          <PrivateAssets>all</PrivateAssets>
+        </PackageReference>
+        <PackageReference Include="Scalar.AspNetCore" Version="2.16.3" />
+    </ItemGroup>
+
+    <ItemGroup>
+      <ProjectReference Include="..\SlpModularCms.Core\SlpModularCms.Core.csproj" />
+      <ProjectReference Include="..\SlpModularCms.Modules.Availability\SlpModularCms.Modules.Availability.csproj" />
+      <ProjectReference Include="..\SlpModularCms.Modules.Identity\SlpModularCms.Modules.Identity.csproj" />
+      <ProjectReference Include="..\SlpModularCms.Modules.Master\SlpModularCms.Modules.Master.csproj" />
+    </ItemGroup>
+
+    <!--
+      The admin SPA (frontend/) is served at /admin (see CmsHost.ConfigurePipeline) from
+      wwwroot/admin, but is deliberately NOT built by an MSBuild target hooked to Build/Publish
+      here — see SlpModularCms.Api.csproj for the full explanation (files must exist on disk
+      before dotnet publish/build runs; the CI workflow handles this as its own step).
+    -->
+
+</Project>

src/SlpModularCms.Api.SlpSoftware/appsettings.Development.json

@@ -0,0 +1,55 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Warning"
+    }
+  },
+  "ConnectionStrings": {
+    // Own, isolated local dev database (Infrastructure Design decision Q1 = B) — deliberately
+    // separate from SlpModularCms.Api's local database, so developing/testing this project
+    // (and the future Offerings module) never touches Api's local data, or vice versa.
+    "DefaultConnection": "Server=127.0.0.1;Port=3306;Database=SlpModularCmsSlpSoftwareDev;Uid=root;Pwd=<your-local-mariadb-password>"
+  },
+  "JwtSettings": {
+    "Secret": "SuperSecretKeyForDevelopmentOnly_MustBeLongerThan32Bytes!",
+    "Issuer": "SlpModularCms",
+    "Audience": "SlpModularCmsPortal",
+    "ExpiryMinutes": 60,
+    "RefreshTokenExpiryDays": 7,
+    "CookieSameSite": "None"
+  },
+  "Availability": {
+    "CircuitBreakerSeconds": 30,
+    "StatusCacheSeconds": 1
+  },
+  "MasterPolling": {
+    "PollIntervalSeconds": 15,
+    "FailOpenAfterMinutes": 2,
+    "HttpTimeoutSeconds": 5
+  },
+  "MasterModule": {
+    "IntegrityCheckIntervalMinutes": 60,
+    "HttpTimeoutSeconds": 10,
+    "MasterUrl": "https://localhost:7223"
+  },
+  "Cors": {
+    // Port 5175, not 5173: that's Api's own frontend dev port (see frontend/package.json's
+    // plain `pnpm dev`). This project is reached via `pnpm dev:slpsoftware`, which runs the
+    // frontend dev server on 5175 (see .env.slpsoftware.local / package.json).
+    "AllowedOrigins": [
+      "http://localhost:5175",
+      "https://localhost:5175"
+    ]
+  },
+  "RateLimiting": {
+    "Login": {
+      "PermitLimit": 100,
+      "WindowSeconds": 60
+    },
+    "Refresh": {
+      "PermitLimit": 500,
+      "WindowSeconds": 60
+    }
+  }
+}

src/SlpModularCms.Api.SlpSoftware/appsettings.json

@@ -0,0 +1,75 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Information",
+      "Microsoft.AspNetCore": "Information",
+      // Pinned at Warning deliberately. At Information, EF prints every SQL statement INCLUDING
+      // parameter values, and the login path passes a normalised email address through it.
+      "Microsoft.EntityFrameworkCore.Database.Command": "Warning"
+    }
+  },
+  "AllowedHosts": "*",
+  "ConnectionStrings": {
+    "DefaultConnection": "Server=<production-db-host>;Port=3306;Database=SlpSoftware<Env>;Uid=<db-user>;Pwd=<db-password>"
+  },
+  "JwtSettings": {
+    "Secret": "<secure-long-random-secret-key-from-env>",
+    "Issuer": "SlpModularCms",
+    "Audience": "SlpModularCmsPortal",
+    "ExpiryMinutes": 60,
+    "RefreshTokenExpiryDays": 7
+  },
+  "Availability": {
+    "CircuitBreakerSeconds": 30,
+    "StatusCacheSeconds": 1
+  },
+  "MasterModule": {
+    "IntegrityCheckIntervalMinutes": 60,
+    "HttpTimeoutSeconds": 10,
+    "MasterUrl": "<public-url-of-this-master-instance>"
+  },
+  "MasterPolling": {
+    "PollIntervalSeconds": 30,
+    "FailOpenAfterMinutes": 5,
+    "HttpTimeoutSeconds": 5
+  },
+  "Cors": {
+    "AllowedOrigins": []
+  },
+  "RateLimiting": {
+    "Login": {
+      "PermitLimit": 5,
+      "WindowSeconds": 60
+    },
+    "Refresh": {
+      "PermitLimit": 20,
+      "WindowSeconds": 60
+    },
+    "SentryTunnel": {
+      "PermitLimit": 60,
+      "WindowSeconds": 60
+    }
+  },
+  "SecurityHeaders": {
+    "Enabled": true,
+    "DefaultPolicy": "Relaxed",
+    "PathPolicies": [
+      { "PathPrefix": "/admin", "Policy": "Strict" },
+      { "PathPrefix": "/api/v1", "Policy": "Strict" },
+      { "PathPrefix": "/health", "Policy": "Strict" }
+    ],
+    "AllowedScriptOrigins": [],
+    "AllowedConnectOrigins": []
+  },
+  "Observability": {
+    // Supplied per environment as Observability__SentryDsn. Empty means Sentry is skipped
+    // entirely and console logging continues — a normal, supported state, not an error.
+    "SentryDsn": "",
+    // Falls back to ASPNETCORE_ENVIRONMENT when empty.
+    "Environment": "",
+    // Sentry's free plan counts transactions against the same quota as errors, and this setup's
+    // value is in errors rather than performance traces.
+    "TracesSampleRate": 0.1,
+    "TunnelMaxPayloadBytes": 204800
+  }
+}