refinement phase 0

server/src/API/Baya.Web.Api/Program.cs

@@ -72,8 +72,14 @@ builder.Services.AddApplicationServices()
     .AddPersistenceServices(configuration)
     .AddCrossCuttingSeams(configuration)
     .AddWebFrameworkServices()
+    .AddCorsPolicies(configuration)
     .AddRateLimitingPolicies();
 
+// Development-only: capture each OTP in-memory so GET /api/v1/dev/last_otp/{phone} can complete a login
+// without an SMS gateway. Nothing here is wired in any other environment.
+if (builder.Environment.IsDevelopment())
+    builder.Services.AddDevelopmentOtpCapture();
+
 builder.Services.RegisterValidatorsAsServices();
 builder.Services.AddExceptionHandler<ExceptionHandler>();
 
@@ -114,6 +120,10 @@ app.UseSwaggerAndUi();
 
 app.UseRouting();
 
+// After UseRouting and before the rate limiter / authentication so a pre-flight OPTIONS is answered
+// (and not rejected as 429/401) before the browser sends the real cross-origin request.
+app.UseCors(CorsServiceExtension.PolicyName);
+
 app.UseRateLimiter();
 
 app.UseAuthentication();