Architecture Review

var builder = WebApplication.CreateBuilder(args);
builder.AddServiceDefaults();                                    // M5: OTel, health, discovery

builder.Services.AddDbContext<RoasteryDbContext>(/* SQLite */); // M2
builder.Services.AddValidation();                                // M2: annotations are enforced
builder.Services.AddProblemDetails();                            // M2: one error shape
builder.Services.AddExceptionHandler<DomainExceptionHandler>();  // M2: domain errors → 409

builder.Services.AddIdentityCore<RoasteryUser>()/* … */;         // M3
builder.Services.AddAuthentication().AddJwtBearer(/* … */);      // M3
builder.Services.AddAuthorizationBuilder()
    .AddPolicy("Staff", /* … */)
    .AddPolicy("OwnsOrder", /* … */);                            // M3: rules live here, not in handlers
builder.Services.AddRateLimiter(/* … */);                        // M3
builder.Services.AddCors(/* … */);                               // M3

builder.Services.AddOutputCache(/* … */);                        // M4: cache public responses
builder.Services.AddHybridCache();                               // M4: cache data in handlers
builder.Services.AddHostedService<OrderReadyNotifier>();         // M4: slow work off the request
builder.Services.AddHttpClient<PaymentClient>()
    .AddStandardResilienceHandler();                             // M4
builder.Services.AddApiVersioning(/* … */);                      // M5
builder.Services.AddOpenApi();                                   // M1

var app = builder.Build();

app.UseExceptionHandler();                                       // outermost: catches everything below
app.UseStatusCodePages();
app.UseHttpsRedirection();
if (!app.Environment.IsDevelopment()) app.UseHsts();
app.UseSecurityHeaders();                                        // M3
app.UseRateLimiter();                                            // before auth: cheap rejection first
app.UseCors("Frontend");
app.UseAuthentication();                                         // who
app.UseAuthorization();                                          // may they
app.UseOutputCache();                                            // after auth: never caches authenticated responses

var v1 = app.MapGroup("/api/v{version:apiVersion}")/* … */;      // M5
v1.MapProductEndpoints();                                        // public GETs cached; staff group locked
v1.MapOrderEndpoints();                                          // whole group authenticated
app.MapGroup("/api/auth").MapIdentityApi<RoasteryUser>().RequireRateLimiting("auth");
app.MapDefaultEndpoints();                                       // /health, /alive
app.MapOpenApi();
app.MapScalarApiReference();

app.Run();

public partial class Program { }                                 // M4: lets the tests see us