Direct DB host is IPv6-only for new Supabase projects and unreachable from
IPv4-only environments. The session pooler (Supavisor, port 5432) is the
correct entry point and keeps prepared statements working with EF Core.
17 bite-sized tasks with manual verification (curl for backend,
browser for frontend) since the spec excludes automated tests
in the first pass. Uses marker-comment replacements in Program.cs
so JWT auth and CORS drop in cleanly without depending on the
exact template output.
Captures the approved brainstorming design: React SPA (Vite+TS) talks only
to the ASP.NET Core Web API; the API validates Supabase JWTs against the
JWKS URL and owns the Postgres connection. Minimal per-user todo CRUD,
local dev only.
