a08138a772
17 bite-sized tasks with manual verification (curl for backend, browser for frontend) since the spec excludes automated tests in the first pass. Uses marker-comment replacements in Program.cs so JWT auth and CORS drop in cleanly without depending on the exact template output.