Handoff — after refinement-phase-0 (Local end-to-end bring-up)

Date: 2026-07-12 · Track: integration (both projects) · Unlocks: every other refinement phase.

What the frontend can now do

Actually call the backend cross-origin. The API now has a CORS policy (BalinyaarWebClient) allowing http://localhost:3000 (config Cors:AllowedOrigins, default in Dev) with the four headers the client sends (Authorization, Content-Type, Accept-Language, Idempotency-Key). A browser at :3000 calling https://localhost:5002 is no longer blocked by same-origin policy.
Stand the stack up in ~5 minutes via dev/post-phase/refinement/RUNBOOK.md (dev-cert trust → local SQL Server via docker compose → connection string via dotnet user-secrets → dotnet run + npm run dev).
Complete a real login end-to-end. Request an OTP, read the 6-digit code from the server console (MOCK SMS — OTP code … for phone ending in …) or from the Development-only helper GET /api/v1/dev/last_otp/{phone}, verify → real tokens + /me.

No USE_*_MOCK flag was flipped. auth is still the only real client domain; the home/search/bookings are still in-browser mocks until Refinement Phase 4.
No client app code changed — only verified client/.env.development (already https://localhost:5002) and added the runbook. If you run the API elsewhere, override with client/.env.local.
Auth crypto, the money path, and the ApiResult envelope are untouched.

GET /api/v1/dev/last_otp/{phone} → { data: { phone, code } } when a code was issued, else 404. 404 in every non-Development environment (the capture isn't even wired there). For manual/e2e login only; superseded by real SMS in Refinement Phase 8. Do not build client features on it.

The API binds HTTP/2 (Kestrel:Protocols = Http2, for gRPC). Browsers negotiate h2-over-TLS via ALPN automatically, so fetch works; curl needs --http2.
The dev HTTPS cert must be trusted (dotnet dev-certs https --trust) or fetch to :5002 fails with an opaque network error.
Committed appsettings*.json connection strings are placeholders — the API will not boot until you set ConnectionStrings:SqlServer via user-secrets (or the ConnectionStrings__SqlServer env var).