17 bite-sized tasks with manual verification (curl for backend,
browser for frontend) since the spec excludes automated tests
in the first pass. Uses marker-comment replacements in Program.cs
so JWT auth and CORS drop in cleanly without depending on the
exact template output.
