Add Ping backend

.NET 10 solution for Ping, a Discord style chat app: Domain, Application
and Infrastructure projects plus the Api host. SignalR for chat and
presence, LiveKit for call tokens, EF Core on Postgres, S3 compatible
storage for attachments, and OIDC auth shared with the Musify Zitadel
instance. Includes the Compose stack for local development.

backend/Hosts/Ping.Api/OpenApi/OpenApiExtensions.cs

@@ -0,0 +1,12 @@
+namespace Ping.Api.OpenApi;
+
+public static class OpenApiExtensions
+{
+    public static IServiceCollection AddOpenApiConfiguration(this IServiceCollection services)
+    {
+        services.AddOpenApi();
+        services.ConfigureOptions<OpenApiOptionsSetup>();
+
+        return services;
+    }
+}

backend/Hosts/Ping.Api/OpenApi/OpenApiOptionsSetup.cs

@@ -0,0 +1,66 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.OpenApi;
+using Microsoft.Extensions.Options;
+using Microsoft.OpenApi;
+using Ping.Api.Authentication;
+
+namespace Ping.Api.OpenApi;
+
+public sealed class OpenApiOptionsSetup(IOptions<AuthenticationConfiguration> options)
+    : IConfigureNamedOptions<OpenApiOptions>
+{
+    private const string SecuritySchemeId = "OAuth2";
+
+    private readonly AuthenticationConfiguration _configuration = options.Value;
+
+    public void Configure(string? name, OpenApiOptions options) => Configure(options);
+
+    public void Configure(OpenApiOptions options)
+    {
+        options.AddDocumentTransformer((document, _, _) =>
+        {
+            document.Components ??= new OpenApiComponents();
+            document.Components.SecuritySchemes ??= new Dictionary<string, IOpenApiSecurityScheme>();
+            document.Components.SecuritySchemes[SecuritySchemeId] = new OpenApiSecurityScheme
+            {
+                Type = SecuritySchemeType.OAuth2,
+                Flows = new OpenApiOAuthFlows
+                {
+                    AuthorizationCode = new OpenApiOAuthFlow
+                    {
+                        AuthorizationUrl = new Uri(_configuration.AuthorizationEndpoint),
+                        TokenUrl = new Uri(_configuration.TokenEndpoint),
+                        Scopes = _configuration.Scopes.ToDictionary(scope => scope, scope => scope),
+                    },
+                },
+            };
+
+            return Task.CompletedTask;
+        });
+
+        options.AddOperationTransformer((operation, context, _) =>
+        {
+            var requiresAuthorization = context.Description.ActionDescriptor.EndpointMetadata
+                .OfType<IAuthorizeData>()
+                .Any();
+
+            var allowsAnonymous = context.Description.ActionDescriptor.EndpointMetadata
+                .OfType<IAllowAnonymous>()
+                .Any();
+
+            if (!requiresAuthorization || allowsAnonymous)
+            {
+                return Task.CompletedTask;
+            }
+
+            operation.Security ??= new List<OpenApiSecurityRequirement>();
+            operation.Security.Add(new OpenApiSecurityRequirement
+            {
+                [new OpenApiSecuritySchemeReference(SecuritySchemeId, context.Document)] =
+                    _configuration.Scopes.ToList(),
+            });
+
+            return Task.CompletedTask;
+        });
+    }
+}