refinement phase 0

dev/shared-working-context/backend/STATUS.md

@@ -12,6 +12,27 @@ One block per completed backend phase. Newest at the top. Backend lane writes he
 - **Notes for frontend:** <anything load-bearing>
 -->
 
+## refinement-phase-0 — Local end-to-end bring-up & the integration seam — 2026-07-12
+- **Shipped (integration/plumbing — no business logic):** **CORS** (`Baya.WebFramework/ServiceConfiguration/
+  CorsServiceExtension.cs` → `AddCorsPolicies`, policy `BalinyaarWebClient` from `Cors:AllowedOrigins`, default
+  `http://localhost:3000`; `app.UseCors` after `UseRouting` / before `UseRateLimiter`; no `AllowCredentials`).
+  **Local DB story** — `server/docker-compose.yml` rewritten to SQL Server 2022 Developer on `localhost:1433`
+  (dev-only SA password); committed `appsettings*.json` connection strings replaced with **non-working
+  placeholders** (real value via `dotnet user-secrets`); added `<UserSecretsId>` to the API csproj.
+  **Development-only OTP helper** `GET /api/v1/dev/last_otp/{phone}` (`DevController` + `DevOtpStore` +
+  `DevCapturingSmsSender`, wired only in Development via `AddDevelopmentOtpCapture`; **404 outside
+  Development**). Wrote `dev/post-phase/refinement/RUNBOOK.md`.
+- **Contracts:** none produced; swagger snapshot **not** regenerated (only new path is the dev-only helper).
+- **Mocked:** no new seam; `ISmsSender` (`LoggingSmsSender`) row updated in mocks-registry (interim OTP channel
+  + the Development-only capture affordance).
+- **Gate:** build clean (0 new warnings) / tests green (**369**: 4 identity + 248 foundation + 117 API, incl.
+  3 new CORS/dev-otp integration tests + 8 dev-otp store/decorator unit tests).
+- **Handoff:** backend/handoff/after-refinement-phase-0.md
+- **Notes for frontend:** the client now really reaches the API cross-origin (CORS unblocked). **No mock flag
+  was flipped — `auth` is still the only real domain** (that's Phase 4). `client/.env.development` already
+  points at `https://localhost:5002`; the API speaks HTTP/2 (browsers negotiate h2-over-TLS automatically).
+  Read the OTP from the server console or `GET /api/v1/dev/last_otp/{phone}` (Development only).
+
 ## backend-phase-15 — Messaging (tickets), partner centers & admin backoffice — 2026-07-10
 - **Shipped (FINAL backend phase):** new `messaging` schema — `Tickets` (`UNIQUE(reference_code)`, status/
   category, nullable `booking_id`/`refund_id`), `TicketParticipants` (`UNIQUE(ticket_id, user_id)`, soft-remove