chore(backend): install AI agent skills for the .NET stack

Run autoskills in backend/: detects .NET/C#/ASP.NET Core/Minimal API and installs 13 skills for universal (.agents) and claude-code (.claude) agents, with backend/skills-lock.json. Adds ASP.NET Core, Minimal API + OpenAPI, file-upload and containerization skills on top of the prior C#/.NET set. Removes the stale root skills from the old layout.
2026-07-05 03:48:31 +02:00
parent f2933caa90
commit 3b98a05c3b
43 changed files with 1808 additions and 0 deletions
@@ -0,0 +1,103 @@
+# Program And Pipeline
+
+Primary docs:
+- https://learn.microsoft.com/aspnet/core/fundamentals/
+- https://learn.microsoft.com/aspnet/core/fundamentals/minimal-apis/webapplication
+- https://learn.microsoft.com/aspnet/core/fundamentals/middleware/
+- https://learn.microsoft.com/aspnet/core/fundamentals/configuration/
+
+## Startup Shape
+
+Prefer the modern hosting model:
+
+1. Create `var builder = WebApplication.CreateBuilder(args);`
+2. Register services on `builder.Services`
+3. Build `var app = builder.Build();`
+4. Configure middleware in the correct order
+5. Map endpoints
+6. Call `app.Run();`
+
+Use older `Startup` patterns only when the repository already uses them or the task is migration.
+
+## Service Registration
+
+- Register framework services explicitly: Razor Pages, controllers, Razor components, authentication, authorization, health checks, rate limiting, response compression, output caching, EF Core, and `IHttpClientFactory`
+- Keep business logic in services instead of controllers, page models, or route handlers
+- Use constructor injection as the default
+- Use options classes for structured configuration
+- Choose lifetimes intentionally:
+  - singleton: stateless or shared infrastructure
+  - scoped: request-bound work such as `DbContext`
+  - transient: lightweight stateless services
+
+## Configuration Defaults
+
+`WebApplication.CreateBuilder` already loads configuration from common providers such as:
+
+- `appsettings.json`
+- environment-specific `appsettings.{Environment}.json`
+- environment variables
+- command-line arguments
+
+For secrets:
+
+- use Secret Manager in development
+- use a secure external store in production
+- do not commit secrets to source control
+
+## Middleware Order
+
+Middleware order is a frequent source of broken behavior. Favor this shape and adjust only with a concrete reason:
+
+1. Forwarded headers if behind a proxy or load balancer
+2. Exception handling and HSTS for non-development environments
+3. HTTPS redirection
+4. Static files
+5. Routing when explicit routing middleware is needed
+6. CORS when endpoints require it
+7. Authentication
+8. Authorization
+9. Endpoint-specific middleware such as rate limiting or session as required
+10. Endpoint mapping with `MapRazorPages`, `MapControllers`, `MapGet`, `MapHub`, or `MapGrpcService`
+
+Important ordering rules:
+
+- Call `UseAuthentication()` before `UseAuthorization()`
+- Keep proxy/header processing before auth, redirects, and link generation
+- Do not insert custom middleware randomly between auth and authorization without a reason
+- In Minimal API apps, explicit `UseRouting()` is usually unnecessary unless you need to control order
+
+## Routing And Endpoints
+
+- Prefer endpoint routing everywhere
+- Use route groups for larger Minimal API surfaces
+- Keep MVC and API routes explicit and predictable
+- Use areas only when the application is large enough to benefit from bounded sections
+- Keep endpoint names stable when generating links or integrating with clients
+
+## Error Handling
+
+- Use centralized exception handling instead of scattered `try/catch` blocks for ordinary request failures
+- Prefer ProblemDetails-style responses for APIs
+- Keep the developer exception page limited to development
+- Separate user-facing failures from internal exception details
+
+## Logging And Diagnostics
+
+- Use `ILogger<T>` from DI
+- Log structured values, not concatenated strings
+- Put correlation and request diagnostics in middleware or infrastructure, not business logic
+- Enable HTTP logging only when the scenario warrants it and avoid leaking sensitive data
+
+## Static Assets And Web Root
+
+- Keep public assets in `wwwroot`
+- Treat the web root as publicly readable content
+- Prevent publishing local-only static content through project file rules when needed
+- Use Razor Class Libraries for reusable UI assets across apps
+
+## Architectural Defaults
+
+- Keep `Program.cs` readable; extract feature registration to extension methods when it starts accumulating unrelated concerns
+- Prefer vertical slices or feature folders over giant "Controllers", "Services", and "Repositories" buckets with weak boundaries
+- Keep framework configuration close to the host and business logic out of it