17 bite-sized tasks with manual verification (curl for backend,
browser for frontend) since the spec excludes automated tests
in the first pass. Uses marker-comment replacements in Program.cs
so JWT auth and CORS drop in cleanly without depending on the
exact template output.
Captures the approved brainstorming design: React SPA (Vite+TS) talks only
to the ASP.NET Core Web API; the API validates Supabase JWTs against the
JWKS URL and owns the Postgres connection. Minimal per-user todo CRUD,
local dev only.
