Captures the approved brainstorming design: React SPA (Vite+TS) talks only to the ASP.NET Core Web API; the API validates Supabase JWTs against the JWKS URL and owns the Postgres connection. Minimal per-user todo CRUD, local dev only.
