hamid
765cc632d5
Remove the Order demo (entity/feature/repo/config/gRPC/proto) and the three pre-marketplace migrations; regenerate a fresh InitialBaseline migration. Stand up the REST surface (PingController + System/Ping CQRS) proving the Mediator -> behaviors -> OperationResult -> ApiResult envelope end to end. Close wiring gaps: register LoggingBehavior (outermost) and add the built-in rate limiter (per-IP global + otp/auth/sensitive policies), placed before authentication. Add current-user + audit plumbing: ICurrentUser (HttpContext + null impls), rename BaseEntity audit fields to CreatedAt/ModifiedAt (DateTimeOffset) + CreatedById/ModifiedById, stamped by a new AuditFieldInterceptor. Introduce five cross-cutting seams (IDateTimeProvider, IFieldEncryptor, ICacheService, IObjectStorage, INotificationDispatcher) with in-memory/local mocks registered via AddCrossCuttingSeams. Add Baya.Test.Foundation (encryptor, audit interceptor, ping handler) and update docs, contracts (swagger.v1.json), handoff, report, and mocks registry.
Phase reports — template
Every phase writes a report here when it finishes (operating-rules §7, Definition of Done). The report is the durable answer to "what did this phase do, what can I test now, and what's still fake?" — saved to a file, not left in chat.
File name: backend-phase-N-report.md or frontend-phase-N-bM-report.md.
# <Backend|Frontend> Phase N — <Title> — Report (<YYYY-MM-DD>)
## What was built
- Bullet list of concrete deliverables (entities/migrations/endpoints, or screens/services/components).
## What is now testable (and exactly how)
- Step-by-step for a human: e.g. "Swagger → POST /api/v1/auth/otp/request with {phone} → 200; the OTP is
logged to the console; POST /api/v1/auth/otp/verify with that code → returns access+refresh tokens."
- For the frontend: which screen, which route, what to click, expected result, how mock data shows up.
## What is mocked / waiting on a real service
- Each seam touched: interface + file, what's faked, and a link to its entry in `mocks-registry.md`.
## Contracts
- Produced (backend): which `contracts/domains/*.md` + openapi snapshot.
- Consumed (frontend): which contract/version; any request filed in `frontend/requests/for-backend.md`.
## Docs updated
- Which CLAUDE.md / product doc / conventions were updated and why.
## Follow-ups for later phases
- Anything intentionally deferred, with the phase that should pick it up.