Drop docker-compose from dev workflow; run full build/test and Aspire locally

dev-build.sh now builds the whole solution and runs .NET + Jest unit tests instead of restarting docker-compose services. readme documents the aspire run command for local orchestration; slnx solution-items reference to the removed docker-compose.yml is gone.
Removing old docker-compose file. Use Aspire instead
2026-07-06 10:44:11 -07:00 · 2026-07-06 10:33:02 -07:00 · 2026-07-06 10:32:04 -07:00 · 2026-07-05 22:54:30 -07:00 · 2026-07-05 16:14:33 -07:00 · 2026-07-05 22:08:11 +00:00
180 changed files with 8894 additions and 2903 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,15 +2,25 @@
 # (both look under .github/workflows/). Every non-checkout step just invokes a
 # bash script under scripts/ci/, so the entire pipeline is reproducible by
 # running the same scripts locally - no marketplace build/test/push actions.
+#
+# Gitea (origin) is the internal/testing remote and runs the full pipeline:
+# build, test, docker push, deploy-to-qa, smoke test. GitHub is the public
+# mirror and only needs to prove the code builds and tests pass - it has no
+# registry secrets and no [self-hosted, qa] runner, so the docker push and
+# deploy/smoke jobs are skipped there via the `github.server_url` check
+# below (identical on both engines: https://github.com on GitHub, the Gitea
+# instance URL on Gitea).
 name: CI

 on:
  push:
-    branches: [main, build-runner-fix]
+    paths-ignore: [badges/**]

 jobs:
  build-and-push:
    runs-on: ubuntu-latest
+    permissions:
+      contents: write
    env:
      REGISTRY: ${{ secrets.REGISTRY }}
      REGISTRY_OWNER: ${{ secrets.REGISTRY_OWNER }}
@@ -25,14 +35,25 @@ jobs:
      - name: Test
        run: ./scripts/ci/test.sh

+      - name: Coverage report
+        run: ./scripts/ci/coverage.sh
+
+      - name: Publish coverage badge
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: ./scripts/ci/publish-coverage-badge.sh
+
      - name: Build Docker images
+        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
        run: ./scripts/ci/docker-build.sh

      - name: Push Docker images
+        if: github.server_url != 'https://github.com' && github.ref_name == 'main'
        run: ./scripts/ci/docker-push.sh

  deploy-qa:
    needs: build-and-push
+    if: github.server_url != 'https://github.com' && github.ref_name == 'main'
    runs-on: [self-hosted, qa]
    env:
      REGISTRY: ${{ secrets.REGISTRY }}
@@ -40,6 +61,7 @@ jobs:
      REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
      REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
      JWT_SECRET_KEY: ${{ secrets.JWT_SECRET_KEY }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
      QA_ADMIN_PORT: ${{ vars.QA_ADMIN_PORT }}
    steps:
      # actions/checkout@v4 is a Node-based action; this runner has no node
@@ -56,9 +78,11 @@ jobs:

  smoke-qa:
    needs: deploy-qa
+    if: github.server_url != 'https://github.com'
    runs-on: [self-hosted, qa]
    env:
      QA_ADMIN_PORT: ${{ vars.QA_ADMIN_PORT }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
    steps:
      # actions/checkout@v4 is a Node-based action; this runner has no node
      # in PATH, so checkout plain git instead of via marketplace action.
--- a/.gitignore
+++ b/.gitignore
@@ -476,3 +476,6 @@ ehthumbs.db

 # Self-installed .NET SDK (scripts/ci/lib.sh ensure_dotnet, used when a CI runner lacks the SDK)
 /.dotnet/
+
+# Self-installed reportgenerator CLI (scripts/ci/lib.sh ensure_reportgenerator)
+/.dotnet-tools/
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,10 +1,10 @@
 # CLAUDE.md

-Guidance for Claude Code (claude.ai/code) when working in this repo.
+Guidance for Claude Code (claude.ai/code) in this repo.

 ## Project

-MicCheck: open source. asp.net, c#, typescript, VueJS. Manages feature flags, projects, environments.
+MicCheck: open source. asp.net, c#, typescript, VueJS. Manage feature flags, projects, environments.

 ## Planned Structure

@@ -18,27 +18,30 @@ MicCheck: open source. asp.net, c#, typescript, VueJS. Manages feature flags, pr
 - Use latest LTS .NET + latest supported nuget packages for that version
 - Set `langVersion` to latest in all csproj files; enable nullable
 - Organize code by feature/area, not type (e.g. `features` namespace)
- New features need unit tests covering as much logic as possible (both nunit and jest)
- Any modified file: evaluate for missing test coverage and that all tests pass
+- New features need unit tests covering logic as much as possible (both nunit and jest)
+- Modified file: check missing test coverage, all tests pass

 # Coding
- Descriptive names for all classes/methods. No generic names: Provider, Manager, Helper
+- Descriptive names all classes/methods. No generic: Provider, Manager, Helper
 - Match formatting/style from `.editorconfig`
- Wrap lines at 220 characters, leave single line if fewer
- Place interfaces that are implemented by a single class at the bottom of the class file.  An interface with multiple implementations of an interface should be in a seperate file.
- Do not use tuples for return types.  Prefer records or classes for multiple values
- Do not use `sealed` 
+- Wrap lines at 220 chars, single line if fewer
+- Interfaces implemented by single class → bottom of class file. Interface w/ multiple implementations → separate file.
+- No tuples for return types. Prefer records or classes for multiple values
+- No `sealed`
 - Use `record` for data objects, `class` for objects with behavior. Avoid mutable state where possible.

 ## Testing
+- Min 70% code coverage, target 90%. Unit tests focus end-user scenarios first.
+- Don't write tests just for coverage. Call out missing coverage rather than cover stuff not valuable to end user.
+- Code not cleanly unit-testable → mark `[ExcludeFromCodeCoverage]` or exclude namespace from coverage in .runsettings file
 - BDD-style unit tests, end-to-end as possible, no external resources (DB, filesystem). e.g. `WhenAUserDoesSomething_ThenAThingAppears`
- Mock external deps with Moq
- Mock EntityFramework DBContexts with an extracted interface and Moq.  Do not rely on InMemory provider.
- New features need unit tests covering as much logic as possible
- Any modified file: evaluate for missing test coverage- 
+- Mock external deps w/ Moq
+- Mock EntityFramework DBContexts via extracted interface + Moq. Don't rely on InMemory provider.
+- New features need unit tests covering logic as much as possible
+- Modified file: check missing test coverage
 - No "Mock" in mocked object names
 - No Arrange/Act/Assert comments
- All tests should pass before commit
+- All tests pass before commit

 ## Claude
 - Plans = `.md` files in `docs/plans/`. Admin → `docs/plans/admin/`, API → `docs/plans/api/`
@@ -47,4 +50,4 @@ MicCheck: open source. asp.net, c#, typescript, VueJS. Manages feature flags, pr
 - Plan implemented from `docs/plans/<name>.md` → save summary as `docs/plans/<name>_output.md`

 ## Stack
-`.gitignore` configured for .NET/Visual Studio (C#, NuGet, MSBuild). Update if stack changes.
+`.gitignore` set for .NET/Visual Studio (C#, NuGet, MSBuild). Update if stack change.
--- a/CLAUDE.original.md
+++ b/CLAUDE.original.md
@@ -1,44 +1,53 @@
 # CLAUDE.md

-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+Guidance for Claude Code (claude.ai/code) when working in this repo.

 ## Project

-MicCheck is an open source project written in asp.net, c#, typescript and VueJS that manages feature flags, their projects, and their environments. 
+MicCheck: open source. asp.net, c#, typescript, VueJS. Manages feature flags, projects, environments.

 ## Planned Structure

- `src/admin/` — administrative components in VueJS
- `src/api/` - api and restful endpoints in .NET
+- `src/admin/` — VueJS admin components
+- `src/api/` - .NET API + REST endpoints
 - `tests/` — test suite
 - `docs/` — documentation

 ## Best Practices

- Ensure all projects are using the latest LTS version of .NET as well as the latest supported nuget packages for that .NET version
- Ensure that langVersion is set to latest in all csproj files and nullable is enabled
- Code in all projects should be organized by feature or area instead of type.  (e.g. a features namespace with all feature related code in it or in child namespaces of it)
- All new feature requests should include corresponding unit tests that cover as much of the logic as possible.
- Any file modified should be evaluated for potential test cases and missing coverage areas.
+- Use latest LTS .NET + latest supported nuget packages for that version
+- Set `langVersion` to latest in all csproj files; enable nullable
+- Organize code by feature/area, not type (e.g. `features` namespace)
+- New features need unit tests covering as much logic as possible (both nunit and jest)
+- Any modified file: evaluate for missing test coverage and that all tests pass

 # Coding
- Use descriptive names for all classes and method created.  Avoid generic names like Provider, Manager, Helper
- Coding should match formating and style rules in the .editorconfig file
+- Descriptive names for all classes/methods. No generic names: Provider, Manager, Helper
+- Match formatting/style from `.editorconfig`
+- Wrap lines at 220 characters, leave single line if fewer
+- Place interfaces that are implemented by a single class at the bottom of the class file.  An interface with multiple implementations of an interface should be in a seperate file.
+- Do not use tuples for return types.  Prefer records or classes for multiple values
+- Do not use `sealed` 
+- Use `record` for data objects, `class` for objects with behavior. Avoid mutable state where possible.

 ## Testing
- Write unit tests in a BDD style, testing as much code end-to-end as possible without without touching external resources like databases or file systems (e.g. WhenAUserDoesSomething_ThenAThingAppears)
- Mock any external dependencies using Moq.
- Do not name any mocked objects with the word Mock in them
- Do not include any Arrange / Act / Assert comments in the code
-
+- Require a minimum of 70% code coverage with a target of 90%.  Unit tests should focus on end-user scenarios first.
+- Do not write tests for just to increase code coverage.  Call out lack of test coverage rather than covering something that isn't valuable to the end user.
+- Code that can not be cleanly unit tested should be marked with [ExcludeFromCodeCoverage] or have it's namespace excluded from code coverage.
+- BDD-style unit tests, end-to-end as possible, no external resources (DB, filesystem). e.g. `WhenAUserDoesSomething_ThenAThingAppears`
+- Mock external deps with Moq
+- Mock EntityFramework DBContexts with an extracted interface and Moq.  Do not rely on InMemory provider.
+- New features need unit tests covering as much logic as possible
+- Any modified file: evaluate for missing test coverage- 
+- No "Mock" in mocked object names
+- No Arrange/Act/Assert comments
+- All tests should pass before commit

 ## Claude
- Create all plans as .md file located in the `docs/` folder.  Admin in `docs/admin/` and API in `docs/api/`
- Divide up large plans into discrete chucks of functionality so each can be built and committed independently.
- When generating a plan from a .md file in /docs/ save the plan in the same folder with the same filename minus the .md extention, but with a _plan.md at the end
- When implementing a plan from a .md file in /docs/ save the summary of the plan in the same folder with the same filename minus the .md extention, but with a _output.md at the end
-
+- Plans = `.md` files in `docs/plans/`. Admin → `docs/plans/admin/`, API → `docs/plans/api/`
+- Split large plans into discrete chunks — each buildable + committable independently
+- Plan generated from `docs/plans/<name>.md` → save as `docs/plans/<name>_plan.md`
+- Plan implemented from `docs/plans/<name>.md` → save summary as `docs/plans/<name>_output.md`

 ## Stack
-
-The `.gitignore` is configured for a .NET/Visual Studio project (C#, NuGet, MSBuild). If this changes, update this file accordingly.
+`.gitignore` configured for .NET/Visual Studio (C#, NuGet, MSBuild). Update if stack changes.
--- a/MicCheck.slnx
+++ b/MicCheck.slnx
@@ -3,7 +3,6 @@
    <File Path=".editorconfig" />
    <File Path=".gitignore" />
    <File Path="CLAUDE.md" />
-    <File Path="docker-compose.yml" />
    <File Path="readme.md" />
  </Folder>
  <Folder Name="/src/">
--- a/badges/coverage.svg
+++ b/badges/coverage.svg
@@ -0,0 +1,138 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="155" height="20">
+    <style type="text/css">
+          <![CDATA[
+            @keyframes fade1 {
+                0% { visibility: visible; opacity: 1; }
+               23% { visibility: visible; opacity: 1; }
+               25% { visibility: hidden; opacity: 0; }
+               48% { visibility: hidden; opacity: 0; }
+               50% { visibility: hidden; opacity: 0; }
+               73% { visibility: hidden; opacity: 0; }
+               75% { visibility: hidden; opacity: 0; }
+               98% { visibility: hidden; opacity: 0; }
+              100% { visibility: visible; opacity: 1; }
+            }
+            @keyframes fade2 {
+                0% { visibility: hidden; opacity: 0; }
+               23% { visibility: hidden; opacity: 0; }
+               25% { visibility: visible; opacity: 1; }
+               48% { visibility: visible; opacity: 1; }
+               50% { visibility: hidden; opacity: 0; }
+               73% { visibility: hidden; opacity: 0; }
+               75% { visibility: hidden; opacity: 0; }
+               98% { visibility: hidden; opacity: 0; }
+              100% { visibility: hidden; opacity: 0; }
+            }
+            @keyframes fade3 {
+                0% { visibility: hidden; opacity: 0; }
+               23% { visibility: hidden; opacity: 0; }
+               25% { visibility: hidden; opacity: 0; }
+               48% { visibility: hidden; opacity: 0; }
+               50% { visibility: visible; opacity: 1; }
+               73% { visibility: visible; opacity: 1; }
+               75% { visibility: hidden; opacity: 0; }
+               98% { visibility: hidden; opacity: 0; }
+              100% { visibility: hidden; opacity: 0; }
+            }
+            @keyframes fade4 {
+                0% { visibility: hidden; opacity: 0; }
+               23% { visibility: hidden; opacity: 0; }
+               25% { visibility: hidden; opacity: 0; }
+               48% { visibility: hidden; opacity: 0; }
+               50% { visibility: hidden; opacity: 0; }
+               73% { visibility: hidden; opacity: 0; }
+               75% { visibility: visible; opacity: 1; }
+               98% { visibility: visible; opacity: 1; }
+              100% { visibility: hidden; opacity: 0; }
+            }
+            .linecoverage {
+                animation-duration: 15s;
+                animation-name: fade1;
+                animation-iteration-count: infinite;
+            }
+            .branchcoverage {
+                animation-duration: 15s;
+                animation-name: fade2;
+                animation-iteration-count: infinite;
+            }
+            .methodcoverage {
+                animation-duration: 15s;
+                animation-name: fade3;
+                animation-iteration-count: infinite;
+            }
+            .fullmethodcoverage {
+                animation-duration: 15s;
+                animation-name: fade4;
+                animation-iteration-count: infinite;
+            }
+          ]]>
+    </style>
+    <title>Code coverage</title>
+    <defs>
+        <linearGradient id="gradient" x2="0" y2="100%">
+            <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+            <stop offset="1" stop-opacity=".1"/>
+        </linearGradient>
+
+        <linearGradient id="c">
+          <stop offset="0" stop-color="#d40000"/>
+          <stop offset="1" stop-color="#ff2a2a"/>
+        </linearGradient>
+        <linearGradient id="a">
+          <stop offset="0" stop-color="#e0e0de"/>
+          <stop offset="1" stop-color="#fff"/>
+        </linearGradient>
+        <linearGradient id="b">
+          <stop offset="0" stop-color="#37c837"/>
+          <stop offset="1" stop-color="#217821"/>
+        </linearGradient>
+        <linearGradient xlink:href="#a" id="e" x1="106.44" x2="69.96" y1="-11.96" y2="-46.84" gradientTransform="matrix(-.8426 -.00045 -.00045 -.8426 -94.27 -75.82)" gradientUnits="userSpaceOnUse"/>
+        <linearGradient xlink:href="#b" id="f" x1="56.19" x2="77.97" y1="-23.45" y2="10.62" gradientTransform="matrix(.8426 .00045 .00045 .8426 94.27 75.82)" gradientUnits="userSpaceOnUse"/>
+        <linearGradient xlink:href="#c" id="g" x1="79.98" x2="132.9" y1="10.79" y2="10.79" gradientTransform="matrix(.8426 .00045 .00045 .8426 94.27 75.82)" gradientUnits="userSpaceOnUse"/>
+
+        <mask id="mask">
+            <rect width="155" height="20" rx="3" fill="#fff"/>
+        </mask>
+
+        <g id="icon" transform="matrix(.04486 0 0 .04481 -.48 -.63)">
+            <rect width="52.92" height="52.92" x="-109.72" y="-27.13" fill="url(#e)" transform="rotate(-135)"/>
+            <rect width="52.92" height="52.92" x="70.19" y="-39.18" fill="url(#f)" transform="rotate(45)"/>
+            <rect width="52.92" height="52.92" x="80.05" y="-15.74" fill="url(#g)" transform="rotate(45)"/>
+        </g>
+    </defs>
+    
+    <g mask="url(#mask)">
+        <rect x="0" y="0" width="90" height="20" fill="#444"/>
+        <rect x="90" y="0" width="20" height="20" fill="#c00"/>
+        <rect x="110" y="0" width="45" height="20" fill="#00B600"/>
+        <rect x="0" y="0" width="155" height="20" fill="url(#gradient)"/>
+    </g>
+
+    <g>
+        <path class="" stroke="#fff" d="M94 6.5 h12 M94 10.5 h12 M94 14.5 h12"/>
+        
+        
+        
+    </g>
+    
+    <g fill="#fff" text-anchor="middle" font-family="Verdana,Arial,Geneva,sans-serif" font-size="11">
+        <a xlink:href="https://github.com/danielpalme/ReportGenerator" target="_top">
+            <title>Generated by: ReportGenerator 5.5.10.0</title>
+            <use xlink:href="#icon" transform="translate(3,1) scale(3.5)"/>
+        </a>
+
+        <text x="53" y="15" fill="#010101" fill-opacity=".3">Coverage</text>
+        <text x="53" y="14" fill="#fff">Coverage</text>
+        <text class="" x="132.5" y="15" fill="#010101" fill-opacity=".3">68.9%</text><text class="" x="132.5" y="14">68.9%</text>
+        
+        
+        
+    </g>
+
+    <g>
+        <rect class="" x="90" y="0" width="65" height="20" fill-opacity="0"><title>Line coverage</title></rect>
+        
+        
+        
+    </g>
+</svg>
--- a/deploy/qa/.env.example
+++ b/deploy/qa/.env.example
@@ -9,4 +9,5 @@ REGISTRY_TOKEN=changeme

 # QA environment
 JWT_SECRET_KEY=change-this-to-a-random-32-plus-char-secret
+POSTGRES_PASSWORD=change-this-to-a-random-password
 QA_ADMIN_PORT=3001
--- a/deploy/qa/docker-compose.qa.yml
+++ b/deploy/qa/docker-compose.qa.yml
@@ -2,9 +2,10 @@ name: miccheck-qa

 # Dedicated, network-isolated QA stack. Not connected to the dev compose
 # stack's network - runs entirely on its own bridge network below. The API has
-# no published host port; Postgres is bound to 127.0.0.1 only, so the smoke-qa
-# CI job (running on this same host) can seed/inspect data directly while it
-# stays unreachable off-box.
+# no published host port; Postgres is bound to DB_BIND_HOST (docker's bridge
+# gateway IP, computed by deploy-qa.sh) so the smoke-qa CI job - itself a
+# sibling container on that same default bridge - can seed/inspect data
+# directly, while it stays unreachable off-box (unlike binding to 0.0.0.0).
 services:

  db:
@@ -12,9 +13,9 @@ services:
    environment:
      POSTGRES_DB: miccheck
      POSTGRES_USER: miccheck
-      POSTGRES_PASSWORD: password
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
    ports:
-      - "127.0.0.1:55432:5432"
+      - "${DB_BIND_HOST:-127.0.0.1}:55432:5432"
    volumes:
      - miccheck-qa-pgdata:/var/lib/postgresql/data
    networks:
@@ -30,7 +31,7 @@ services:
    environment:
      ASPNETCORE_ENVIRONMENT: Development
      ASPNETCORE_URLS: http://+:8080
-      ConnectionStrings__miccheck: "Host=db;Database=miccheck;Username=miccheck;Password=password"
+      ConnectionStrings__miccheck: "Host=db;Database=miccheck;Username=miccheck;Password=${POSTGRES_PASSWORD}"
      Jwt__SecretKey: ${JWT_SECRET_KEY}
      Jwt__Issuer: MicCheck
      Jwt__Audience: MicCheck
--- a/dev-build.sh
+++ b/dev-build.sh
@@ -3,27 +3,19 @@ set -e

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

-build_api() {
-  echo "Building API..."
-  dotnet publish "$SCRIPT_DIR/src/api/MicCheck.Api/MicCheck.Api.csproj" -c Release -o "$SCRIPT_DIR/src/api/MicCheck.Api/publish"
-  docker compose -f "$SCRIPT_DIR/docker-compose.yml" restart api
-  echo "API done."
-}
+echo "Building solution..."
+dotnet build "$SCRIPT_DIR/MicCheck.slnx"

-build_admin() {
-  echo "Building admin..."
-  npm --prefix "$SCRIPT_DIR/src/admin" ci --silent
-  npm --prefix "$SCRIPT_DIR/src/admin" run build
-  docker compose -f "$SCRIPT_DIR/docker-compose.yml" restart admin
-  echo "Admin done."
-}
+echo "Installing admin dependencies..."
+npm --prefix "$SCRIPT_DIR/src/admin" ci --silent

-case "${1:-all}" in
-  api)   build_api ;;
-  admin) build_admin ;;
-  all)   build_api && build_admin ;;
-  *)
-    echo "Usage: $0 [api|admin|all]"
-    exit 1
-    ;;
-esac
+echo "Building admin..."
+npm --prefix "$SCRIPT_DIR/src/admin" run build
+
+echo "Running .NET unit tests..."
+dotnet test "$SCRIPT_DIR/tests/api/MicCheck.Api.Tests.Unit/MicCheck.Api.Tests.Unit.csproj"
+
+echo "Running Jest tests..."
+npm --prefix "$SCRIPT_DIR/src/admin" test
+
+echo "Build and tests complete."
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,60 +0,0 @@
-services:
-
-  # ── PostgreSQL ───────────────────────────────────────────────────────────────
-  db:
-    image: postgres:16-alpine
-    environment:
-      POSTGRES_DB: miccheck
-      POSTGRES_USER: miccheck
-      POSTGRES_PASSWORD: password
-    ports:
-      - "5432:5432"
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U miccheck -d miccheck"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-  # ── .NET API ─────────────────────────────────────────────────────────────────
-  api:
-    build:
-      context: .
-      dockerfile: src/api/MicCheck.Api/Dockerfile
-    ports:
-      - "8080:8080"
-    volumes:
-      - ./src/api/MicCheck.Api/publish:/app
-    environment:
-      ASPNETCORE_ENVIRONMENT: Development
-      ASPNETCORE_URLS: http://+:8080
-      ConnectionStrings__DefaultConnection: "Host=db;Database=miccheck;Username=miccheck;Password=password"
-      Jwt__SecretKey: "miccheck-dev-secret-key-change-in-production!!"
-      Jwt__Issuer: MicCheck
-      Jwt__Audience: MicCheck
-    depends_on:
-      db:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8080/api/v1/health 2>/dev/null || exit 0"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-      start_period: 20s
-
-  # ── Vue Admin Site (nginx) ───────────────────────────────────────────────────
-  admin:
-    build:
-      context: src/admin
-      dockerfile: Dockerfile
-    ports:
-      - "3000:80"
-    volumes:
-      - ./src/admin/dist:/usr/share/nginx/html
-    depends_on:
-      api:
-        condition: service_started
-
-volumes:
-  postgres_data:
--- a/readme.md
+++ b/readme.md
@@ -1,5 +1,9 @@
 # MicCheck

+[![GitHub CI](https://github.com/wamplerj/mic-check/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/wamplerj/mic-check/actions/workflows/ci.yml)
+[![Gitea CI](https://git.wampler.us/wamplerj/mic-check/actions/workflows/ci.yml/badge.svg?branch=main)](https://git.wampler.us/wamplerj/mic-check/actions?workflow=ci.yml)
+![Coverage](badges/coverage.svg)
+
 Open source feature flag management platform. Manage projects, environments, feature flags, segments, and identities across your apps.

 Built with .NET (API) and Vue.js + Vuetify (admin UI).
@@ -25,10 +29,11 @@ Code in the API is organized by feature area (e.g. `Features`, `Segments`, `Iden

 ## Running locally

-`docker-compose.yml` provides supporting services. `MicCheck.AppHost` (.NET Aspire) orchestrates the API and admin app for local development.
+`MicCheck.AppHost` (.NET Aspire) orchestrates the API, admin app, and supporting services for local development.

 ```sh
 ./dev-build.sh
+aspire run --project src/MicCheck.AppHost
 ```

 ## Testing
--- a/scripts/ci/coverage.sh
+++ b/scripts/ci/coverage.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Merges the .NET (coverlet/Cobertura) and admin (Jest/lcov) coverage output
+# produced by test.sh into one report via reportgenerator, prints a summary,
+# appends a build-report summary when running under Actions, and refreshes
+# the coverage badge committed at badges/coverage.svg. Readme embeds that
+# badge via a relative path, which resolves on both GitHub and Gitea since
+# the same repo content is pushed to both remotes.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+ensure_dotnet
+ensure_reportgenerator
+
+REPORT_DIR="$CI_ROOT/coverage/report"
+
+log "Merging coverage reports with reportgenerator"
+reportgenerator \
+  -reports:"coverage/dotnet/**/coverage.cobertura.xml;src/admin/coverage/lcov.info" \
+  -targetdir:"$REPORT_DIR" \
+  -reporttypes:"Badges;MarkdownSummaryGithub;TextSummary"
+
+cat "$REPORT_DIR/Summary.txt"
+
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+  cat "$REPORT_DIR/SummaryGithub.md" >> "$GITHUB_STEP_SUMMARY"
+fi
+
+mkdir -p "$CI_ROOT/badges"
+cp "$REPORT_DIR/badge_linecoverage.svg" "$CI_ROOT/badges/coverage.svg"
+
+log "coverage.sh complete"
--- a/scripts/ci/deploy-qa.sh
+++ b/scripts/ci/deploy-qa.sh
@@ -11,8 +11,15 @@ registry_login

 export API_IMAGE ADMIN_IMAGE
 export JWT_SECRET_KEY="${JWT_SECRET_KEY:?JWT_SECRET_KEY env var is required}"
+export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:?POSTGRES_PASSWORD env var is required}"
 export QA_ADMIN_PORT="${QA_ADMIN_PORT:-3001}"

+# Bind narrowly to docker's bridge gateway IP rather than 0.0.0.0: reachable
+# from the smoke-qa job container (a sibling on the default bridge), but not
+# exposed on the host's public interface.
+export DB_BIND_HOST="$(docker_bridge_gateway)"
+[[ -n "$DB_BIND_HOST" ]] || fail "could not determine docker bridge gateway IP to bind the QA db port"
+
 COMPOSE="docker compose -p miccheck-qa -f deploy/qa/docker-compose.qa.yml"

 log "Pulling latest :qa images"
--- a/scripts/ci/lib.sh
+++ b/scripts/ci/lib.sh
@@ -52,6 +52,34 @@ ensure_dotnet() {
  fi
  export PATH="$install_dir:$PATH"
  export DOTNET_ROOT="$install_dir"
+
+  ensure_dotnet_native_deps
+}
+
+# The .NET runtime is a native ELF binary that dynamically links libstdc++/libgcc.
+# Bare/minimal images (e.g. the act hostexecutor container) may lack them entirely,
+# which fails as an obscure symbol-relocation error rather than "command not found".
+ensure_dotnet_native_deps() {
+  if ldconfig -p 2>/dev/null | grep -q 'libstdc++\.so\.6'; then
+    return 0
+  fi
+
+  log "libstdc++.so.6 missing; installing native runtime deps for dotnet"
+  local sudo_cmd=""
+  if [[ "$(id -u)" -ne 0 ]] && command -v sudo > /dev/null 2>&1; then
+    sudo_cmd="sudo"
+  fi
+
+  if command -v apt-get > /dev/null 2>&1; then
+    $sudo_cmd apt-get update -y
+    $sudo_cmd apt-get install -y --no-install-recommends libstdc++6 libgcc-s1 libicu-dev ca-certificates
+  elif command -v apk > /dev/null 2>&1; then
+    # Alpine/musl runner - dotnet-install.sh falls back to the linux-musl-x64 SDK
+    # here, which still wants a real libstdc++/libgcc (not just gcompat).
+    $sudo_cmd apk add --no-cache libstdc++ libgcc icu-libs ca-certificates
+  else
+    fail "libstdc++.so.6 missing and neither apt-get nor apk is available; install a C++ runtime manually on this runner"
+  fi
 }

 # Installs Node.js into $CI_ROOT/.node from the official prebuilt tarball if
@@ -63,12 +91,33 @@ ensure_node() {
    return 0
  fi

+  # nodejs.org only ships glibc binaries; on a musl/Alpine runner (same one
+  # dotnet-install.sh detects and picks the linux-musl-x64 SDK for) that
+  # tarball fails to exec at all ("env: can't execute 'node'"). Prefer the
+  # distro's own package on musl instead of a broken glibc download.
+  if [[ ! -x "$CI_ROOT/.node/bin/node" ]] && command -v apk > /dev/null 2>&1; then
+    log "node not found on PATH; installing via apk (musl runner)"
+    local sudo_cmd=""
+    if [[ "$(id -u)" -ne 0 ]] && command -v sudo > /dev/null 2>&1; then
+      sudo_cmd="sudo"
+    fi
+    $sudo_cmd apk add --no-cache nodejs npm
+    return 0
+  fi
+
  local node_version="22.14.0"
  local install_dir="$CI_ROOT/.node"
  if [[ ! -x "$install_dir/bin/node" ]]; then
    log "node not found on PATH; installing Node.js v$node_version"
    local tarball="node-v${node_version}-linux-x64"
-    curl -fsSL "https://nodejs.org/dist/v${node_version}/${tarball}.tar.xz" -o "/tmp/${tarball}.tar.xz"
+    local url="https://nodejs.org/dist/v${node_version}/${tarball}.tar.xz"
+    if command -v curl > /dev/null 2>&1; then
+      curl -fsSL "$url" -o "/tmp/${tarball}.tar.xz"
+    elif command -v wget > /dev/null 2>&1; then
+      wget -q "$url" -O "/tmp/${tarball}.tar.xz"
+    else
+      fail "neither curl nor wget found on PATH; cannot download Node.js"
+    fi
    mkdir -p "$install_dir"
    tar -xJf "/tmp/${tarball}.tar.xz" -C "$install_dir" --strip-components=1
    rm -f "/tmp/${tarball}.tar.xz"
@@ -76,6 +125,32 @@ ensure_node() {
  export PATH="$install_dir/bin:$PATH"
 }

+# Installs the dotnet-reportgenerator-globaltool CLI (merges coverlet/Jest
+# coverage output into badges + build-summary markdown) into $CI_ROOT/.dotnet-tools
+# if it isn't already on PATH. Mirrors ensure_dotnet()/ensure_node() above.
+ensure_reportgenerator() {
+  if command -v reportgenerator > /dev/null 2>&1; then
+    return 0
+  fi
+
+  local tool_dir="$CI_ROOT/.dotnet-tools"
+  if [[ ! -x "$tool_dir/reportgenerator" ]]; then
+    log "reportgenerator not found on PATH; installing dotnet-reportgenerator-globaltool"
+    dotnet tool install dotnet-reportgenerator-globaltool --tool-path "$tool_dir"
+  fi
+  export PATH="$tool_dir:$PATH"
+}
+
+# The IP address on which a container published on 0.0.0.0/<gateway-ip> is
+# reachable from a sibling container on docker's default bridge network (i.e.
+# the docker host's bridge-side address, not its public interface). Used to
+# bind QA's db port narrowly - reachable by the smoke-qa job container, not
+# exposed off-box the way 0.0.0.0 would be.
+docker_bridge_gateway() {
+  docker network inspect bridge -f '{{(index .IPAM.Config 0).Gateway}}' 2>/dev/null \
+    || ip route show default 2>/dev/null | awk '/default/ {print $3; exit}'
+}
+
 registry_login() {
  require_registry_vars
  [[ -n "$REGISTRY_USER" ]] || fail "REGISTRY_USER env var is required to push images"
--- a/scripts/ci/publish-coverage-badge.sh
+++ b/scripts/ci/publish-coverage-badge.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Commits the coverage badge refreshed by coverage.sh straight back to the
+# branch that triggered this run, so readme.md's relative badges/coverage.svg
+# link stays current. GITHUB_SERVER_URL/GITHUB_REPOSITORY/GITHUB_REF_NAME are
+# default context env vars on both GitHub Actions and Gitea Actions (Gitea's
+# engine is GitHub-Actions-compatible); GITHUB_TOKEN must be passed in
+# explicitly from the workflow (${{ github.token }}) on both platforms.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+[[ -n "${GITHUB_TOKEN:-}" ]] || fail "GITHUB_TOKEN env var is required to push the badge commit"
+[[ -n "${GITHUB_SERVER_URL:-}" ]] || fail "GITHUB_SERVER_URL env var is required to push the badge commit"
+[[ -n "${GITHUB_REPOSITORY:-}" ]] || fail "GITHUB_REPOSITORY env var is required to push the badge commit"
+[[ -n "${GITHUB_REF_NAME:-}" ]] || fail "GITHUB_REF_NAME env var is required to push the badge commit"
+
+if git diff --quiet -- badges/coverage.svg; then
+  log "badges/coverage.svg unchanged; nothing to publish"
+  exit 0
+fi
+
+git config user.name "miccheck-ci"
+git config user.email "ci@miccheck.local"
+git add badges/coverage.svg
+git commit -m "chore: refresh coverage badge [skip ci]"
+
+remote_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+git -c http.extraheader="AUTHORIZATION: bearer ${GITHUB_TOKEN}" push "$remote_url" "HEAD:${GITHUB_REF_NAME}"
+
+log "publish-coverage-badge.sh complete"
--- a/scripts/ci/smoke-qa.sh
+++ b/scripts/ci/smoke-qa.sh
@@ -2,8 +2,11 @@
 # Post-deploy validation for the QA environment: runs the API integration
 # suite (real HTTP + real Postgres, seeding/cleaning up its own data) and the
 # Playwright admin e2e suite against the just-deployed QA stack. Intended to
-# run immediately after deploy-qa.sh, on the same self-hosted qa runner, so
-# `localhost` resolves to the deployed containers.
+# run immediately after deploy-qa.sh, on the same self-hosted qa runner. This
+# job runs in its own job container, a sibling of the QA stack's containers
+# on docker's default bridge network - not "localhost" from the host's point
+# of view - so it reaches published ports via the bridge gateway IP, same as
+# deploy-qa.sh binds the db port to.
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
 cd "$CI_ROOT"
@@ -12,19 +15,41 @@ ensure_dotnet
 ensure_node

 QA_ADMIN_PORT="${QA_ADMIN_PORT:-3001}"
-BASE_URL="http://localhost:${QA_ADMIN_PORT}"
+CI_HOST="$(docker_bridge_gateway)"
+[[ -n "$CI_HOST" ]] || fail "could not determine docker bridge gateway IP to reach the QA stack"
+BASE_URL="http://${CI_HOST}:${QA_ADMIN_PORT}"
+
+log "Resolved docker host as $CI_HOST for reaching the QA stack's published ports"

 export MICCHECK_API_BASE_URL="$BASE_URL"
-export MICCHECK_DB_CONNECTION_STRING="${MICCHECK_DB_CONNECTION_STRING:-Host=localhost;Port=55432;Database=miccheck;Username=miccheck;Password=password}"
+export MICCHECK_DB_CONNECTION_STRING="${MICCHECK_DB_CONNECTION_STRING:-Host=$CI_HOST;Port=55432;Database=miccheck;Username=miccheck;Password=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD env var is required}}"

 log "Running API integration suite against $BASE_URL"
 dotnet test tests/api/MicCheck.Api.Tests.Integration/MicCheck.Api.Tests.Integration.csproj -c Release --logger trx

 log "Installing admin e2e dependencies"
 npm --prefix src/admin ci
-npm --prefix src/admin run e2e:install

-log "Running Playwright admin e2e suite against $BASE_URL"
-E2E_BASE_URL="$BASE_URL" npm --prefix src/admin run e2e
+# Playwright's bundled Chromium is a glibc binary and `--with-deps` only knows
+# apt - neither works on this musl/Alpine runner. Run the e2e leg inside
+# Microsoft's official Playwright image instead (glibc, browsers preinstalled
+# at /ms-playwright), as a sibling container reachable at the same bridge
+# gateway IP used above. Pin the image tag to the exact resolved
+# @playwright/test version so the test runner and browser build match.
+#
+# This script itself runs inside the runner's own job container, talking to
+# the host's docker daemon over a mounted socket (docker-outside-of-docker) -
+# `docker run -v "$CI_ROOT:/work"` would ask the *host* daemon to bind-mount a
+# path that only exists inside this job container, which fails. `docker cp`
+# instead copies the files by content, sidestepping the path mismatch.
+PW_VERSION="$(node -p "require('./src/admin/node_modules/@playwright/test/package.json').version")"
+log "Running Playwright admin e2e suite against $BASE_URL (playwright:v$PW_VERSION-noble)"
+
+PW_CONTAINER="$(docker create -e "E2E_BASE_URL=$BASE_URL" -w /work/src/admin "mcr.microsoft.com/playwright:v${PW_VERSION}-noble" npm run e2e)"
+docker cp "$CI_ROOT/." "$PW_CONTAINER:/work"
+pw_status=0
+docker start -a "$PW_CONTAINER" || pw_status=$?
+docker rm -f "$PW_CONTAINER" > /dev/null
+[[ "$pw_status" -eq 0 ]] || fail "Playwright e2e suite failed (exit $pw_status)"

 log "smoke-qa.sh complete - QA environment validated end to end"
--- a/scripts/ci/test.sh
+++ b/scripts/ci/test.sh
@@ -8,10 +8,19 @@ cd "$CI_ROOT"

 ensure_dotnet

+# --results-directory doesn't clear prior runs - it adds a new GUID folder
+# alongside old ones every time. On a runner that reuses its workspace
+# (self-hosted, unlike GitHub's ephemeral ones), stale coverage from past
+# runs would otherwise get merged in by coverage.sh and silently skew the
+# combined percentage.
+rm -rf "$CI_ROOT/coverage/dotnet"
+
 log "Running MicCheck.Api.Tests.Unit"
-dotnet test tests/api/MicCheck.Api.Tests.Unit/MicCheck.Api.Tests.Unit.csproj -c Release --logger trx
+dotnet test tests/api/MicCheck.Api.Tests.Unit/MicCheck.Api.Tests.Unit.csproj -c Release --logger trx \
+  --collect:"XPlat Code Coverage" --results-directory "$CI_ROOT/coverage/dotnet" \
+  --settings tests/api/MicCheck.Api.Tests.Unit/coverlet.runsettings

 log "Running admin Jest tests"
-npm --prefix src/admin test
+npm --prefix src/admin test -- --coverage --coverageReporters=lcov --coverageReporters=text-summary

 log "test.sh complete"
--- a/src/admin/e2e/features.e2e.ts
+++ b/src/admin/e2e/features.e2e.ts
@@ -29,7 +29,15 @@ test('creating a feature adds it to the table and its toggle can be flipped', as
  const toggle = row.locator('input[type="checkbox"]');
  const wasChecked = await toggle.isChecked();

+  // Assert on the real PATCH landing, not just the switch's transient DOM state: if the
+  // feature-state map hasn't loaded for this row yet, the click handler no-ops silently and
+  // the switch briefly flashes the native checkbox state before Vue snaps it back - which
+  // reads as "toggled" for an instant even though nothing was ever sent to the API.
+  const patchResponse = page.waitForResponse(
+    (res) => res.request().method() === 'PATCH' && res.url().includes('/featurestate/') && res.ok(),
+  );
  await toggle.click({ force: true });
+  await patchResponse;
  await expect(toggle).toBeChecked({ checked: !wasChecked });

  // Reload to confirm the toggle was persisted to the real API/DB, not just local state.
--- a/src/admin/package-lock.json
+++ b/src/admin/package-lock.json
@@ -6012,16 +6012,15 @@
      }
    },
    "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
-      "license": "MIT",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
      "dependencies": {
        "asynckit": "^0.4.0",
        "combined-stream": "^1.0.8",
        "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
      },
      "engines": {
        "node": ">= 6"
@@ -8430,11 +8429,10 @@
      "license": "MIT"
    },
    "node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
+      "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
      "dev": true,
-      "license": "MIT",
      "dependencies": {
        "argparse": "^1.0.7",
        "esprima": "^4.0.0"
--- a/src/api/MicCheck.Api/Audit/AuditLog.cs
+++ b/src/api/MicCheck.Api/Audit/AuditLog.cs
@@ -1,6 +1,6 @@
 namespace MicCheck.Api.Audit;

-public class AuditLog
+public record AuditLog
 {
    public int Id { get; init; }
    public required string ResourceType { get; init; }
--- a/src/api/MicCheck.Api/Audit/AuditLogQueryService.cs
+++ b/src/api/MicCheck.Api/Audit/AuditLogQueryService.cs
@@ -1,33 +1,30 @@
+using MicCheck.Api.Common;
 using MicCheck.Api.Data;
 using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Audit;

-public class AuditLogQueryService(MicCheckDbContext db)
+public class AuditLogQueryService(IMicCheckDbContext db)
 {
-    public async Task<(int Total, IReadOnlyList<AuditLogResponse> Items)> ListByOrganizationAsync(
-        int organizationId, AuditLogFilter filter, CancellationToken ct = default)
+    public async Task<PagedResult<AuditLogResponse>> ListByOrganizationAsync(int organizationId, AuditLogFilter filter, CancellationToken ct = default)
    {
        var query = db.AuditLogs.Where(l => l.OrganizationId == organizationId);
        return await ApplyFilterAndPageAsync(query, filter, ct);
    }

-    public async Task<(int Total, IReadOnlyList<AuditLogResponse> Items)> ListByProjectAsync(
-        int projectId, AuditLogFilter filter, CancellationToken ct = default)
+    public async Task<PagedResult<AuditLogResponse>> ListByProjectAsync(int projectId, AuditLogFilter filter, CancellationToken ct = default)
    {
        var query = db.AuditLogs.Where(l => l.ProjectId == projectId);
        return await ApplyFilterAndPageAsync(query, filter, ct);
    }

-    public async Task<(int Total, IReadOnlyList<AuditLogResponse> Items)> ListByEnvironmentAsync(
-        int environmentId, AuditLogFilter filter, CancellationToken ct = default)
+    public async Task<PagedResult<AuditLogResponse>> ListByEnvironmentAsync(int environmentId, AuditLogFilter filter, CancellationToken ct = default)
    {
        var query = db.AuditLogs.Where(l => l.EnvironmentId == environmentId);
        return await ApplyFilterAndPageAsync(query, filter, ct);
    }

-    private async Task<(int Total, IReadOnlyList<AuditLogResponse> Items)> ApplyFilterAndPageAsync(
-        IQueryable<AuditLog> query, AuditLogFilter filter, CancellationToken ct)
+    private async Task<PagedResult<AuditLogResponse>> ApplyFilterAndPageAsync(IQueryable<AuditLog> query, AuditLogFilter filter, CancellationToken ct)
    {
        if (filter.From.HasValue)
            query = query.Where(l => l.CreatedAt >= filter.From.Value);
@@ -63,6 +60,6 @@ public class AuditLogQueryService(MicCheckDbContext db)
                    user != null ? user.FirstName + " " + user.LastName : null))
            .ToListAsync(ct);

-        return (total, items);
+        return new PagedResult<AuditLogResponse>(total, items);
    }
 }
--- a/src/api/MicCheck.Api/Audit/AuditLogsController.cs
+++ b/src/api/MicCheck.Api/Audit/AuditLogsController.cs
@@ -12,48 +12,40 @@ namespace MicCheck.Api.Audit;
 [ApiController]
 [Authorize(Policy = AuthorizationPolicies.AdminApiAccess)]
 [EnableRateLimiting("AdminApi")]
+[Route("api/v1")]
 public class AuditLogsController(
    AuditLogQueryService auditLogQueryService,
    OrganizationService organizationService,
    ProjectService projectService,
    EnvironmentService environmentService) : ControllerBase
 {
-    [HttpGet("api/v1/organisation/{id}/audit-logs")]
-    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByOrganization(
-        int id,
-        [FromQuery] AuditLogFilter filter,
-        CancellationToken ct)
+    [HttpGet("organisation/{id}/audit-logs")]
+    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByOrganization(int id, [FromQuery] AuditLogFilter filter, CancellationToken ct)
    {
        var org = await organizationService.FindByIdAsync(id, ct);
        if (org is null) return NotFound();

-        var (total, logs) = await auditLogQueryService.ListByOrganizationAsync(id, filter, ct);
-        return Ok(new PaginatedResponse<AuditLogResponse>(total, null, null, logs.ToList()));
+        var result = await auditLogQueryService.ListByOrganizationAsync(id, filter, ct);
+        return Ok(new PaginatedResponse<AuditLogResponse>(result.Total, null, null, result.Items.ToList()));
    }

-    [HttpGet("api/v1/project/{projectId}/audit-logs")]
-    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByProject(
-        int projectId,
-        [FromQuery] AuditLogFilter filter,
-        CancellationToken ct)
+    [HttpGet("project/{projectId}/audit-logs")]
+    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByProject(int projectId, [FromQuery] AuditLogFilter filter, CancellationToken ct)
    {
        var project = await projectService.FindByIdAsync(projectId, ct);
        if (project is null) return NotFound();

-        var (total, logs) = await auditLogQueryService.ListByProjectAsync(projectId, filter, ct);
-        return Ok(new PaginatedResponse<AuditLogResponse>(total, null, null, logs.ToList()));
+        var result = await auditLogQueryService.ListByProjectAsync(projectId, filter, ct);
+        return Ok(new PaginatedResponse<AuditLogResponse>(result.Total, null, null, result.Items.ToList()));
    }

-    [HttpGet("api/v1/environment/{apiKey}/audit-logs")]
-    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByEnvironment(
-        string apiKey,
-        [FromQuery] AuditLogFilter filter,
-        CancellationToken ct)
+    [HttpGet("environment/{apiKey}/audit-logs")]
+    public async Task<ActionResult<PaginatedResponse<AuditLogResponse>>> ListByEnvironment(string apiKey, [FromQuery] AuditLogFilter filter, CancellationToken ct)
    {
        var environment = await environmentService.FindByApiKeyAsync(apiKey, ct);
        if (environment is null) return NotFound();

-        var (total, logs) = await auditLogQueryService.ListByEnvironmentAsync(environment.Id, filter, ct);
-        return Ok(new PaginatedResponse<AuditLogResponse>(total, null, null, logs.ToList()));
+        var result = await auditLogQueryService.ListByEnvironmentAsync(environment.Id, filter, ct);
+        return Ok(new PaginatedResponse<AuditLogResponse>(result.Total, null, null, result.Items.ToList()));
    }
 }
--- a/src/api/MicCheck.Api/Audit/AuditService.cs
+++ b/src/api/MicCheck.Api/Audit/AuditService.cs
@@ -4,7 +4,7 @@ using MicCheck.Api.Webhooks;

 namespace MicCheck.Api.Audit;

-public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContextAccessor, WebhookQueue webhookQueue)
+public class AuditService(IMicCheckDbContext db, IHttpContextAccessor httpContextAccessor, WebhookQueue webhookQueue) : IAuditService
 {
    private static readonly JsonSerializerOptions JsonOptions = new()
    {
@@ -12,7 +12,7 @@ public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContext
        PropertyNamingPolicy = JsonNamingPolicy.CamelCase
    };

-    public virtual async Task RecordAsync(
+    public async Task RecordAsync(
        string resourceType,
        string resourceId,
        string action,
@@ -33,7 +33,7 @@ public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContext
            }, JsonOptions);
        }

-        var actorUserId = ResolveActorUserId();
+        var actorUserId = GetCurrentUserId();

        var log = new AuditLog
        {
@@ -68,7 +68,7 @@ public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContext
    }

    // Backward-compatible overload used by existing callers
-    public virtual async Task LogAsync(
+    public async Task LogAsync(
        string resourceType,
        string resourceId,
        string action,
@@ -78,7 +78,7 @@ public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContext
        string? changes = null,
        CancellationToken ct = default)
    {
-        var actorUserId = ResolveActorUserId();
+        var actorUserId = GetCurrentUserId();

        var log = new AuditLog
        {
@@ -112,9 +112,33 @@ public class AuditService(MicCheckDbContext db, IHttpContextAccessor httpContext
        });
    }

-    private int? ResolveActorUserId()
+    private int? GetCurrentUserId()
    {
        var claim = httpContextAccessor.HttpContext?.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
        return int.TryParse(claim, out var id) ? id : null;
    }
 }
+
+public interface IAuditService
+{
+    Task RecordAsync(
+        string resourceType,
+        string resourceId,
+        string action,
+        int organizationId,
+        int? projectId = null,
+        int? environmentId = null,
+        object? before = null,
+        object? after = null,
+        CancellationToken ct = default);
+
+    Task LogAsync(
+        string resourceType,
+        string resourceId,
+        string action,
+        int organizationId,
+        int? projectId = null,
+        int? environmentId = null,
+        string? changes = null,
+        CancellationToken ct = default);
+}
--- a/src/api/MicCheck.Api/Audit/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Audit/DependencyRegistration.cs
@@ -0,0 +1,12 @@
+namespace MicCheck.Api.Audit;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddAuditServices(this IServiceCollection services)
+    {
+        services.AddScoped<IAuditService, AuditService>();
+        services.AddScoped<AuditLogQueryService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Common/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Common/DependencyRegistration.cs
@@ -0,0 +1,65 @@
+using System.Text;
+using MicCheck.Api.Common.Security.ApiKeys;
+using MicCheck.Api.Common.Security.Authentication;
+using MicCheck.Api.Common.Security.Authorization;
+using MicCheck.Api.Common.Validation;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.IdentityModel.Tokens;
+
+namespace MicCheck.Api.Common;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddCommonServices(this IServiceCollection services, IConfiguration configuration)
+    {
+        services.AddAuthentication()
+            .AddScheme<AuthenticationSchemeOptions, EnvironmentKeyAuthenticationHandler>(
+                EnvironmentKeyAuthenticationHandler.SchemeName, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
+                ApiKeyAuthenticationHandler.SchemeName, _ => { })
+            .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuer = true,
+                    ValidateAudience = true,
+                    ValidateIssuerSigningKey = true,
+                    ValidIssuer = configuration["Jwt:Issuer"],
+                    ValidAudience = configuration["Jwt:Audience"],
+                    IssuerSigningKey = new SymmetricSecurityKey(
+                        Encoding.UTF8.GetBytes(configuration["Jwt:SecretKey"]!))
+                };
+            });
+
+        services.AddAuthorization(options =>
+        {
+            options.AddPolicy(AuthorizationPolicies.FlagsApiAccess, policy =>
+                policy.AddAuthenticationSchemes(EnvironmentKeyAuthenticationHandler.SchemeName)
+                      .RequireClaim("EnvironmentId"));
+
+            options.AddPolicy(AuthorizationPolicies.AdminApiAccess, policy =>
+                policy.AddAuthenticationSchemes(ApiKeyAuthenticationHandler.SchemeName, JwtBearerDefaults.AuthenticationScheme)
+                      .RequireAuthenticatedUser());
+
+            options.AddPolicy(AuthorizationPolicies.OrganizationAdmin, policy =>
+                policy.AddAuthenticationSchemes(ApiKeyAuthenticationHandler.SchemeName, JwtBearerDefaults.AuthenticationScheme)
+                      .RequireClaim("OrganizationRole", "Admin"));
+        });
+
+        services.AddScoped<ITokenService, TokenService>();
+        services.AddScoped<AuthService>();
+        services.AddScoped<ApiKeyService>();
+        services.AddScoped<IAuthorizationHandler, ProjectPermissionRequirementHandler>();
+
+        services.AddModelValidatorsFromAssemblyContaining<Program>();
+        services.Configure<ApiBehaviorOptions>(options =>
+        {
+            options.InvalidModelStateResponseFactory = context => ValidationProblemResponseFactory.Create(context.ModelState);
+        });
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Common/Guard.cs
+++ b/src/api/MicCheck.Api/Common/Guard.cs
@@ -0,0 +1,40 @@
+namespace MicCheck.Api.Common;
+
+public static class Guard
+{
+    public static void Null<T>(T t, string parameterName) where T : class
+    {
+        if (t is null)
+            throw new ArgumentNullException(parameterName, $"{nameof(parameterName)} can not be null");
+    }
+
+    public static void Empty(string value, string parameterName)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+            throw new ArgumentException($"{parameterName} can not be empty", parameterName);
+    }
+
+    public static void Empty<T>(IEnumerable<T> collection, string parameterName)
+    {
+        if (collection == null || !collection.Any())
+            throw new ArgumentException($"{parameterName} can not be empty", parameterName);
+    }
+
+    public static void Negative(int value, string parameterName)
+    {
+        if (value < 0)
+            throw new ArgumentOutOfRangeException(parameterName, $"{parameterName} must be a positive number or zero");
+    }
+
+    public static void NegativeOrZero(int value, string parameterName)
+    {
+        if (value <= 0)
+            throw new ArgumentOutOfRangeException(parameterName, $"{nameof(parameterName)} must be a positive number greater then zero");
+    }
+
+    public static void Default<T>(T value, string parameterName)
+    {
+        if (EqualityComparer<T>.Default.Equals(value, default))
+            throw new ArgumentException($"{parameterName} can not be a default value", parameterName);
+    }
+}
--- a/src/api/MicCheck.Api/Common/PagedResult.cs
+++ b/src/api/MicCheck.Api/Common/PagedResult.cs
@@ -0,0 +1,3 @@
+namespace MicCheck.Api.Common;
+
+public record PagedResult<T>(int Total, IReadOnlyList<T> Items);
--- a/src/api/MicCheck.Api/Common/PaginatedResponse.cs
+++ b/src/api/MicCheck.Api/Common/PaginatedResponse.cs
@@ -1,8 +1,3 @@
 namespace MicCheck.Api.Common;

-public record PaginatedResponse<T>(
-    int Count,
-    string? Next,
-    string? Previous,
-    IReadOnlyList<T> Results
-);
+public record PaginatedResponse<T>(int Count, string? Next, string? Previous, IReadOnlyList<T> Results);
--- a/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKey.cs
+++ b/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKey.cs
@@ -3,11 +3,11 @@ namespace MicCheck.Api.Common.Security.ApiKeys;
 public class ApiKey
 {
    public int Id { get; init; }
-    public required string Key { get; set; }
-    public required string Prefix { get; set; }
-    public required string Name { get; set; }
+    public required string Key { get; init; }
+    public required string Prefix { get; init; }
+    public required string Name { get; init; }
    public int OrganizationId { get; init; }
    public bool IsActive { get; set; }
-    public DateTimeOffset? ExpiresAt { get; set; }
+    public DateTimeOffset? ExpiresAt { get; init; }
    public DateTimeOffset CreatedAt { get; init; }
 }
--- a/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyEndpoints.cs
+++ b/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyEndpoints.cs
@@ -1,7 +1,9 @@
+using System.Diagnostics.CodeAnalysis;
 using MicCheck.Api.Common.Security.Authorization;

 namespace MicCheck.Api.Common.Security.ApiKeys;

+[ExcludeFromCodeCoverage(Justification = "Minimal-API route registration; requires a live HTTP pipeline to exercise, which CLAUDE.md disallows (no WebApplicationFactory/InMemory). Branch logic is covered via ApiKeyService unit tests.")]
 public static class ApiKeyEndpoints
 {
    public static void MapApiKeyEndpoints(this WebApplication app)
@@ -13,10 +15,9 @@ public static class ApiKeyEndpoints

        group.MapPost("/api-keys", async (int organizationId, CreateApiKeyRequest request, ApiKeyService apiKeyService, CancellationToken ct) =>
        {
-            var (key, rawKey) = await apiKeyService.CreateAsync(
-                organizationId, request.Name, request.ExpiresAt, ct);
+            var result = await apiKeyService.CreateAsync(organizationId, request.Name, request.ExpiresAt, ct);

-            return Results.Ok(new CreateApiKeyResponse(key.Id, key.Name, rawKey, key.Prefix, key.ExpiresAt));
+            return Results.Ok(new CreateApiKeyResponse(result.Key.Id, result.Key.Name, result.RawKey, result.Key.Prefix, result.Key.ExpiresAt));

        }).WithName("CreateApiKey");

--- a/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyResponse.cs
+++ b/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyResponse.cs
@@ -1,9 +1,3 @@
 namespace MicCheck.Api.Common.Security.ApiKeys;

-public record ApiKeyResponse(
-    int Id,
-    string Name,
-    string Prefix,
-    bool IsActive,
-    DateTimeOffset? ExpiresAt,
-    DateTimeOffset CreatedAt);
+public record ApiKeyResponse(int Id, string Name, string Prefix, bool IsActive, DateTimeOffset? ExpiresAt, DateTimeOffset CreatedAt);
--- a/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyService.cs
+++ b/src/api/MicCheck.Api/Common/Security/ApiKeys/ApiKeyService.cs
@@ -3,9 +3,9 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Common.Security.ApiKeys;

-public class ApiKeyService(MicCheckDbContext db)
+public class ApiKeyService(IMicCheckDbContext db)
 {
-    public async Task<(ApiKey Key, string RawKey)> CreateAsync(
+    public async Task<ApiKeyCreationResult> CreateAsync(
        int organizationId, string name, DateTimeOffset? expiresAt, CancellationToken ct = default)
    {
        var rawKey = ApiKeyHasher.GenerateKey();
@@ -26,7 +26,7 @@ public class ApiKeyService(MicCheckDbContext db)
        db.ApiKeys.Add(apiKey);
        await db.SaveChangesAsync(ct);

-        return (apiKey, rawKey);
+        return new ApiKeyCreationResult(apiKey, rawKey);
    }

    public async Task<IReadOnlyList<ApiKey>> ListAsync(int organizationId, CancellationToken ct = default)
@@ -48,3 +48,5 @@ public class ApiKeyService(MicCheckDbContext db)
        await db.SaveChangesAsync(ct);
    }
 }
+
+public record ApiKeyCreationResult(ApiKey Key, string RawKey);
--- a/src/api/MicCheck.Api/Common/Security/Authentication/ApiKeyAuthenticationHandler.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authentication/ApiKeyAuthenticationHandler.cs
@@ -8,7 +8,7 @@ using Microsoft.Extensions.Options;

 namespace MicCheck.Api.Common.Security.Authentication;

-public class ApiKeyAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, MicCheckDbContext db) 
+public class ApiKeyAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, IMicCheckDbContext db) 
    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
 {
    public const string SchemeName = "ApiKey";
--- a/src/api/MicCheck.Api/Common/Security/Authentication/EnvironmentKeyAuthenticationHandler.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authentication/EnvironmentKeyAuthenticationHandler.cs
@@ -7,7 +7,7 @@ using Microsoft.Extensions.Options;

 namespace MicCheck.Api.Common.Security.Authentication;

-public class EnvironmentKeyAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, MicCheckDbContext db)
+public class EnvironmentKeyAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, IMicCheckDbContext db)
    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
 {
    public const string SchemeName = "EnvironmentKey";
--- a/src/api/MicCheck.Api/Common/Security/Authorization/AuthEndpoints.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authorization/AuthEndpoints.cs
@@ -1,7 +1,9 @@
+using System.Diagnostics.CodeAnalysis;
 using Microsoft.AspNetCore.Mvc;

 namespace MicCheck.Api.Common.Security.Authorization;

+[ExcludeFromCodeCoverage(Justification = "Minimal-API route registration; requires a live HTTP pipeline to exercise, which CLAUDE.md disallows (no WebApplicationFactory/InMemory). Branch logic is covered via AuthService unit tests.")]
 public static class AuthEndpoints
 {
    public static void MapAuthEndpoints(this WebApplication app)
--- a/src/api/MicCheck.Api/Common/Security/Authorization/AuthService.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authorization/AuthService.cs
@@ -8,7 +8,7 @@ using Microsoft.EntityFrameworkCore;
 namespace MicCheck.Api.Common.Security.Authorization;

 public class AuthService(
-    MicCheckDbContext db,
+    IMicCheckDbContext db,
    ITokenService tokenService,
    IPasswordHasher<User> passwordHasher)
 {
@@ -81,7 +81,9 @@ public class AuthService(
        });
        await db.SaveChangesAsync(ct);

-        await db.Entry(user).Collection(u => u.Organizations).LoadAsync(ct);
+        var organizationUsers = await db.OrganizationUsers.Where(ou => ou.UserId == user.Id).ToListAsync(ct);
+        foreach (var organizationUser in organizationUsers)
+            user.Organizations.Add(organizationUser);

        var accessToken = tokenService.GenerateToken(user);
        var refreshTokenValue = GenerateSecureToken();
--- a/src/api/MicCheck.Api/Common/Security/Authorization/ProjectPermissionRequirement.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authorization/ProjectPermissionRequirement.cs
@@ -2,9 +2,4 @@ using Microsoft.AspNetCore.Authorization;

 namespace MicCheck.Api.Common.Security.Authorization;

-public class ProjectPermissionRequirement : IAuthorizationRequirement
-{
-    public ProjectPermission Permission { get; }
-
-    public ProjectPermissionRequirement(ProjectPermission permission) => Permission = permission;
-}
+public record ProjectPermissionRequirement(ProjectPermission Permission) : IAuthorizationRequirement;
--- a/src/api/MicCheck.Api/Common/Security/Authorization/ProjectPermissionRequirementHandler.cs
+++ b/src/api/MicCheck.Api/Common/Security/Authorization/ProjectPermissionRequirementHandler.cs
@@ -7,7 +7,7 @@ using Microsoft.EntityFrameworkCore;
 namespace MicCheck.Api.Common.Security.Authorization;

 public class ProjectPermissionRequirementHandler(
-    MicCheckDbContext db,
+    IMicCheckDbContext db,
    IHttpContextAccessor httpContextAccessor)
    : AuthorizationHandler<ProjectPermissionRequirement>
 {
--- a/src/api/MicCheck.Api/Common/Validation/IModelValidator.cs
+++ b/src/api/MicCheck.Api/Common/Validation/IModelValidator.cs
@@ -0,0 +1,13 @@
+namespace MicCheck.Api.Common.Validation;
+
+public interface IModelValidator
+{
+    ValidationResult Validate(object model);
+}
+
+public interface IModelValidator<in T> : IModelValidator
+{
+    ValidationResult Validate(T model);
+
+    ValidationResult IModelValidator.Validate(object model) => Validate((T)model);
+}
--- a/src/api/MicCheck.Api/Common/Validation/ModelValidationActionFilter.cs
+++ b/src/api/MicCheck.Api/Common/Validation/ModelValidationActionFilter.cs
@@ -0,0 +1,28 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace MicCheck.Api.Common.Validation;
+
+public class ModelValidationActionFilter : IActionFilter
+{
+    public void OnActionExecuting(ActionExecutingContext context)
+    {
+        foreach (var argument in context.ActionArguments.Values)
+        {
+            if (argument is null) continue;
+
+            var validatorType = typeof(IModelValidator<>).MakeGenericType(argument.GetType());
+            if (context.HttpContext.RequestServices.GetService(validatorType) is not IModelValidator validator) continue;
+
+            var result = validator.Validate(argument);
+            foreach (var error in result.Errors)
+                context.ModelState.AddModelError(error.PropertyName, error.Message);
+        }
+
+        if (!context.ModelState.IsValid)
+            context.Result = ValidationProblemResponseFactory.Create(context.ModelState);
+    }
+
+    public void OnActionExecuted(ActionExecutedContext context)
+    {
+    }
+}
--- a/src/api/MicCheck.Api/Common/Validation/ModelValidatorServiceCollectionExtensions.cs
+++ b/src/api/MicCheck.Api/Common/Validation/ModelValidatorServiceCollectionExtensions.cs
@@ -0,0 +1,20 @@
+using Microsoft.Extensions.DependencyInjection;
+
+namespace MicCheck.Api.Common.Validation;
+
+public static class ModelValidatorServiceCollectionExtensions
+{
+    public static IServiceCollection AddModelValidatorsFromAssemblyContaining<TMarker>(this IServiceCollection services)
+    {
+        var registrations = typeof(TMarker).Assembly.GetTypes()
+            .Where(type => !type.IsAbstract && !type.IsInterface)
+            .SelectMany(type => type.GetInterfaces()
+                .Where(i => i.IsGenericType && i.GetGenericTypeDefinition() == typeof(IModelValidator<>))
+                .Select(i => (Interface: i, Implementation: type)));
+
+        foreach (var (@interface, implementation) in registrations)
+            services.AddScoped(@interface, implementation);
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Common/Validation/ValidationProblemResponseFactory.cs
+++ b/src/api/MicCheck.Api/Common/Validation/ValidationProblemResponseFactory.cs
@@ -0,0 +1,18 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ModelBinding;
+
+namespace MicCheck.Api.Common.Validation;
+
+public static class ValidationProblemResponseFactory
+{
+    public static IActionResult Create(ModelStateDictionary modelState)
+    {
+        var errors = modelState
+            .Where(e => e.Value?.Errors.Count > 0)
+            .ToDictionary(
+                kvp => kvp.Key,
+                kvp => kvp.Value!.Errors.Select(e => e.ErrorMessage).ToArray());
+
+        return new UnprocessableEntityObjectResult(new { errors });
+    }
+}
--- a/src/api/MicCheck.Api/Common/Validation/ValidationResult.cs
+++ b/src/api/MicCheck.Api/Common/Validation/ValidationResult.cs
@@ -0,0 +1,14 @@
+namespace MicCheck.Api.Common.Validation;
+
+public record ValidationError(string PropertyName, string Message);
+
+public class ValidationResult
+{
+    private readonly List<ValidationError> _errors = [];
+
+    public IReadOnlyList<ValidationError> Errors => _errors;
+    public bool IsValid => _errors.Count == 0;
+    public bool IsInvalid => _errors.Count > 0;
+
+    public void AddError(string propertyName, string message) => _errors.Add(new ValidationError(propertyName, message));
+}
--- a/src/api/MicCheck.Api/Data/Configurations/FeatureUsageDailyConfiguration.cs
+++ b/src/api/MicCheck.Api/Data/Configurations/FeatureUsageDailyConfiguration.cs
@@ -1,4 +1,4 @@
-using MicCheck.Api.Features;
+using MicCheck.Api.Features.Usage;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.EntityFrameworkCore.Metadata.Builders;

--- a/src/api/MicCheck.Api/Data/DatabaseSeeder.cs
+++ b/src/api/MicCheck.Api/Data/DatabaseSeeder.cs
@@ -7,7 +7,7 @@ using AppEnvironment = MicCheck.Api.Environments.Environment;

 namespace MicCheck.Api.Data;

-public class DatabaseSeeder
+public class DatabaseSeeder(MicCheckDbContext db, IPasswordHasher<User> passwordHasher)
 {
    /// <summary>
    /// Deterministic credentials for the development/QA seed admin user. Only ever created when
@@ -15,25 +15,17 @@ public class DatabaseSeeder
    /// Used by the API integration suite and the Playwright admin e2e suite to authenticate
    /// without depending on per-run registration.
    /// </summary>
-    public const string SeedAdminEmail = "admin@miccheck.local";
-    public const string SeedAdminPassword = "MicCheckQa!2026";
+    private const string SeedAdminEmail = "admin@miccheck.local";
+
+    private const string SeedAdminPassword = "MicCheckQa!2026";

    /// <summary>Deterministic environment key for the seeded Development environment, so
    /// HTTP-only integration/e2e tests can read flags without a direct DB connection.</summary>
-    public const string SeedDevelopmentEnvironmentKey = "env-qa-development";
-
-    private readonly MicCheckDbContext _db;
-    private readonly IPasswordHasher<User> _passwordHasher;
-
-    public DatabaseSeeder(MicCheckDbContext db, IPasswordHasher<User> passwordHasher)
-    {
-        _db = db;
-        _passwordHasher = passwordHasher;
-    }
+    private const string SeedDevelopmentEnvironmentKey = "env-qa-development";

    public async Task SeedAsync(CancellationToken ct = default)
    {
-        if (await _db.Organizations.AnyAsync(ct))
+        if (await db.Organizations.AnyAsync(ct))
            return;

        var organization = new Organization
@@ -41,8 +33,8 @@ public class DatabaseSeeder
            Name = "Default",
            CreatedAt = DateTimeOffset.UtcNow
        };
-        _db.Organizations.Add(organization);
-        await _db.SaveChangesAsync(ct);
+        db.Organizations.Add(organization);
+        await db.SaveChangesAsync(ct);

        var project = new Project
        {
@@ -50,13 +42,13 @@ public class DatabaseSeeder
            OrganizationId = organization.Id,
            CreatedAt = DateTimeOffset.UtcNow
        };
-        _db.Projects.Add(project);
-        await _db.SaveChangesAsync(ct);
+        db.Projects.Add(project);
+        await db.SaveChangesAsync(ct);

        var environmentNames = new[] { "Development", "Staging", "Production" };
        foreach (var name in environmentNames)
        {
-            _db.Environments.Add(new AppEnvironment
+            db.Environments.Add(new AppEnvironment
            {
                Name = name,
                ApiKey = name == "Development" ? SeedDevelopmentEnvironmentKey : $"env-{Guid.NewGuid():N}",
@@ -65,7 +57,7 @@ public class DatabaseSeeder
            });
        }

-        await _db.SaveChangesAsync(ct);
+        await db.SaveChangesAsync(ct);

        var adminUser = new User
        {
@@ -76,17 +68,17 @@ public class DatabaseSeeder
            CreatedAt = DateTimeOffset.UtcNow,
            PasswordHash = string.Empty
        };
-        adminUser.PasswordHash = _passwordHasher.HashPassword(adminUser, SeedAdminPassword);
-        _db.Users.Add(adminUser);
-        await _db.SaveChangesAsync(ct);
+        adminUser.PasswordHash = passwordHasher.HashPassword(adminUser, SeedAdminPassword);
+        db.Users.Add(adminUser);
+        await db.SaveChangesAsync(ct);

-        _db.OrganizationUsers.Add(new OrganizationUser
+        db.OrganizationUsers.Add(new OrganizationUser
        {
            OrganizationId = organization.Id,
            UserId = adminUser.Id,
            Role = OrganizationRole.Admin,
            IsPrimary = true
        });
-        await _db.SaveChangesAsync(ct);
+        await db.SaveChangesAsync(ct);
    }
 }
--- a/src/api/MicCheck.Api/Data/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Data/DependencyRegistration.cs
@@ -0,0 +1,21 @@
+using Microsoft.EntityFrameworkCore;
+
+namespace MicCheck.Api.Data;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddDataServices(this IServiceCollection services, IConfiguration configuration)
+    {
+        services.AddScoped<DatabaseSeeder>();
+
+        var connectionString = configuration.GetConnectionString("miccheck")
+            ?? (System.Environment.GetEnvironmentVariable("DATABASE_URL") is { } databaseUrl
+                ? DatabaseUrlParser.ToNpgsqlConnectionString(databaseUrl)
+                : configuration.GetConnectionString("DefaultConnection")!);
+
+        services.AddDbContext<MicCheckDbContext>(options => options.UseNpgsql(connectionString));
+        services.AddScoped<IMicCheckDbContext>(sp => sp.GetRequiredService<MicCheckDbContext>());
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Data/MicCheckDbContext.cs
+++ b/src/api/MicCheck.Api/Data/MicCheckDbContext.cs
@@ -2,6 +2,7 @@ using MicCheck.Api.Common.Security.ApiKeys;
 using MicCheck.Api.Audit;
 using MicCheck.Api.Common.Security.Authorization;
 using MicCheck.Api.Features;
+using MicCheck.Api.Features.Usage;
 using MicCheck.Api.Identities;
 using MicCheck.Api.Organizations;
 using MicCheck.Api.Projects;
@@ -13,7 +14,7 @@ using AppEnvironment = MicCheck.Api.Environments.Environment;

 namespace MicCheck.Api.Data;

-public class MicCheckDbContext : DbContext
+public class MicCheckDbContext : DbContext, IMicCheckDbContext
 {
    public MicCheckDbContext(DbContextOptions<MicCheckDbContext> options) : base(options) { }

@@ -42,3 +43,31 @@ public class MicCheckDbContext : DbContext
    protected override void OnModelCreating(ModelBuilder modelBuilder)
        => modelBuilder.ApplyConfigurationsFromAssembly(typeof(MicCheckDbContext).Assembly);
 }
+
+public interface IMicCheckDbContext
+{
+    DbSet<Organization> Organizations { get; }
+    DbSet<OrganizationUser> OrganizationUsers { get; }
+    DbSet<Project> Projects { get; }
+    DbSet<AppEnvironment> Environments { get; }
+    DbSet<Feature> Features { get; }
+    DbSet<FeatureState> FeatureStates { get; }
+    DbSet<FeatureSegment> FeatureSegments { get; }
+    DbSet<Tag> Tags { get; }
+    DbSet<Segment> Segments { get; }
+    DbSet<SegmentRule> SegmentRules { get; }
+    DbSet<SegmentCondition> SegmentConditions { get; }
+    DbSet<Identity> Identities { get; }
+    DbSet<IdentityTrait> IdentityTraits { get; }
+    DbSet<AuditLog> AuditLogs { get; }
+    DbSet<Webhook> Webhooks { get; }
+    DbSet<WebhookDeliveryLog> WebhookDeliveryLogs { get; }
+    DbSet<ApiKey> ApiKeys { get; }
+    DbSet<User> Users { get; }
+    DbSet<RefreshToken> RefreshTokens { get; }
+    DbSet<UserProjectPermission> UserProjectPermissions { get; }
+    DbSet<FeatureUsageDaily> FeatureUsageDaily { get; }
+
+    int SaveChanges();
+    Task<int> SaveChangesAsync(CancellationToken cancellationToken = default);
+}
--- a/src/api/MicCheck.Api/Environments/CloneEnvironmentRequest.cs
+++ b/src/api/MicCheck.Api/Environments/CloneEnvironmentRequest.cs
@@ -1,13 +1,20 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Environments;

 public record CloneEnvironmentRequest(string Name);

-public class CloneEnvironmentRequestValidator : AbstractValidator<CloneEnvironmentRequest>
+public class CloneEnvironmentRequestValidator : IModelValidator<CloneEnvironmentRequest>
 {
-    public CloneEnvironmentRequestValidator()
+    public ValidationResult Validate(CloneEnvironmentRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Environments/CreateEnvironmentRequest.cs
+++ b/src/api/MicCheck.Api/Environments/CreateEnvironmentRequest.cs
@@ -1,14 +1,23 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Environments;

 public record CreateEnvironmentRequest(string Name, int ProjectId);

-public class CreateEnvironmentRequestValidator : AbstractValidator<CreateEnvironmentRequest>
+public class CreateEnvironmentRequestValidator : IModelValidator<CreateEnvironmentRequest>
 {
-    public CreateEnvironmentRequestValidator()
+    public ValidationResult Validate(CreateEnvironmentRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
-        RuleFor(x => x.ProjectId).GreaterThan(0);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        if (model.ProjectId <= 0)
+            result.AddError(nameof(model.ProjectId), "'Project Id' must be greater than 0.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Environments/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Environments/DependencyRegistration.cs
@@ -0,0 +1,12 @@
+namespace MicCheck.Api.Environments;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddEnvironmentsServices(this IServiceCollection services)
+    {
+        services.AddScoped<EnvironmentService>();
+        services.AddScoped<EnvironmentDocumentService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Environments/EnvironmentDocumentService.cs
+++ b/src/api/MicCheck.Api/Environments/EnvironmentDocumentService.cs
@@ -5,7 +5,7 @@ using AppEnvironment = MicCheck.Api.Environments.Environment;

 namespace MicCheck.Api.Environments;

-public class EnvironmentDocumentService(MicCheckDbContext db)
+public class EnvironmentDocumentService(IMicCheckDbContext db)
 {
    public async Task<EnvironmentDocumentResponse?> GetAsync(int environmentId, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Environments/EnvironmentService.cs
+++ b/src/api/MicCheck.Api/Environments/EnvironmentService.cs
@@ -7,7 +7,7 @@ using AppEnvironment = MicCheck.Api.Environments.Environment;

 namespace MicCheck.Api.Environments;

-public class EnvironmentService(MicCheckDbContext db, AuditService auditService)
+public class EnvironmentService(IMicCheckDbContext db, IAuditService auditService)
 {
    public async Task<IReadOnlyList<AppEnvironment>> ListByProjectAsync(int projectId, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Environments/EnvironmentsController.cs
+++ b/src/api/MicCheck.Api/Environments/EnvironmentsController.cs
@@ -141,8 +141,8 @@ public class EnvironmentsController(EnvironmentService environmentService, Webho
        var environment = await environmentService.FindByApiKeyAsync(apiKey, ct);
        if (environment is null) return NotFound();

-        var (_, logs) = await auditLogQueryService.ListByEnvironmentAsync(environment.Id, new Audit.AuditLogFilter(), ct);
-        return Ok(logs.ToList());
+        var result = await auditLogQueryService.ListByEnvironmentAsync(environment.Id, new Audit.AuditLogFilter(), ct);
+        return Ok(result.Items.ToList());
    }

    [HttpGet("api/v1/environment/{apiKey}/identities")]
@@ -157,9 +157,9 @@ public class EnvironmentsController(EnvironmentService environmentService, Webho
        var environment = await environmentService.FindByApiKeyAsync(apiKey, ct);
        if (environment is null) return NotFound();

-        var (total, items) = await adminIdentityService.ListAsync(environment.Id, page, pageSize, ct);
-        var results = items.Select(Identities.AdminIdentityResponse.From).ToList();
-        return Ok(new PaginatedResponse<Identities.AdminIdentityResponse>(total, null, null, results));
+        var result = await adminIdentityService.ListAsync(environment.Id, page, pageSize, ct);
+        var results = result.Items.Select(Identities.AdminIdentityResponse.From).ToList();
+        return Ok(new PaginatedResponse<Identities.AdminIdentityResponse>(result.Total, null, null, results));
    }

    [HttpPost("api/v1/environment/{apiKey}/identities")]
--- a/src/api/MicCheck.Api/Environments/UpdateEnvironmentRequest.cs
+++ b/src/api/MicCheck.Api/Environments/UpdateEnvironmentRequest.cs
@@ -1,13 +1,20 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Environments;

 public record UpdateEnvironmentRequest(string Name);

-public class UpdateEnvironmentRequestValidator : AbstractValidator<UpdateEnvironmentRequest>
+public class UpdateEnvironmentRequestValidator : IModelValidator<UpdateEnvironmentRequest>
 {
-    public UpdateEnvironmentRequestValidator()
+    public ValidationResult Validate(UpdateEnvironmentRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Features/CreateFeatureRequest.cs
+++ b/src/api/MicCheck.Api/Features/CreateFeatureRequest.cs
@@ -1,26 +1,28 @@
-using FluentValidation;
+using System.Text.RegularExpressions;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Features;

-public record CreateFeatureRequest(
-    string Name,
-    FeatureType Type,
-    string? InitialValue,
-    string? Description
-);
+public record CreateFeatureRequest(string Name, FeatureType Type, string? InitialValue, string? Description);

-public class CreateFeatureRequestValidator : AbstractValidator<CreateFeatureRequest>
+public class CreateFeatureRequestValidator : IModelValidator<CreateFeatureRequest>
 {
-    public CreateFeatureRequestValidator()
-    {
-        RuleFor(x => x.Name)
-            .NotEmpty()
-            .MaximumLength(150)
-            .Matches("^[a-zA-Z0-9_-]+$")
-            .WithMessage("Name may only contain letters, digits, underscores, and hyphens.");
+    private static readonly Regex NamePattern = new("^[a-zA-Z0-9_-]+$");

-        RuleFor(x => x.InitialValue)
-            .MaximumLength(20_000)
-            .When(x => x.InitialValue is not null);
+    public ValidationResult Validate(CreateFeatureRequest model)
+    {
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 150)
+            result.AddError(nameof(model.Name), "'Name' must be 150 characters or fewer.");
+        else if (!NamePattern.IsMatch(model.Name))
+            result.AddError(nameof(model.Name), "Name may only contain letters, digits, underscores, and hyphens.");
+
+        if (model.InitialValue is not null && model.InitialValue.Length > 20_000)
+            result.AddError(nameof(model.InitialValue), "'Initial Value' must be 20000 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Features/CreateTagRequest.cs
+++ b/src/api/MicCheck.Api/Features/CreateTagRequest.cs
@@ -1,16 +1,30 @@
-using FluentValidation;
+using System.Text.RegularExpressions;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Features;

 public record CreateTagRequest(string Label, string Color);

-public class CreateTagRequestValidator : AbstractValidator<CreateTagRequest>
+public class CreateTagRequestValidator : IModelValidator<CreateTagRequest>
 {
-    public CreateTagRequestValidator()
+    private static readonly Regex ColorPattern = new("^#[0-9A-Fa-f]{3,6}$");
+
+    public ValidationResult Validate(CreateTagRequest model)
    {
-        RuleFor(x => x.Label).NotEmpty().MaximumLength(100);
-        RuleFor(x => x.Color).NotEmpty().MaximumLength(20)
-            .Matches("^#[0-9A-Fa-f]{3,6}$")
-            .WithMessage("Color must be a valid hex color (e.g. #FF0000).");
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Label))
+            result.AddError(nameof(model.Label), "'Label' must not be empty.");
+        else if (model.Label.Length > 100)
+            result.AddError(nameof(model.Label), "'Label' must be 100 characters or fewer.");
+
+        if (string.IsNullOrEmpty(model.Color))
+            result.AddError(nameof(model.Color), "'Color' must not be empty.");
+        else if (model.Color.Length > 20)
+            result.AddError(nameof(model.Color), "'Color' must be 20 characters or fewer.");
+        else if (!ColorPattern.IsMatch(model.Color))
+            result.AddError(nameof(model.Color), "Color must be a valid hex color (e.g. #FF0000).");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Features/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Features/DependencyRegistration.cs
@@ -0,0 +1,20 @@
+using MicCheck.Api.Features.Usage;
+
+namespace MicCheck.Api.Features;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddFeaturesServices(this IServiceCollection services)
+    {
+        services.AddScoped<FeatureEvaluationService>();
+        services.AddSingleton<FlagCache>();
+        services.AddScoped<FeatureService>();
+        services.AddScoped<FeatureStateService>();
+        services.AddScoped<FeatureSegmentService>();
+        services.AddScoped<TagService>();
+
+        services.AddFeatureUsageServices();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Features/FeatureEvaluationService.cs
+++ b/src/api/MicCheck.Api/Features/FeatureEvaluationService.cs
@@ -1,4 +1,5 @@
 using MicCheck.Api.Data;
+using MicCheck.Api.Features.Usage;
 using MicCheck.Api.Identities;
 using MicCheck.Api.Segments;
 using Microsoft.EntityFrameworkCore;
@@ -6,7 +7,7 @@ using Microsoft.EntityFrameworkCore;
 namespace MicCheck.Api.Features;

 public class FeatureEvaluationService(
-    MicCheckDbContext db,
+    IMicCheckDbContext db,
    SegmentEvaluator segmentEvaluator,
    FlagCache flagCache,
    FeatureUsageMetrics usageMetrics)
--- a/src/api/MicCheck.Api/Features/FeatureSegmentService.cs
+++ b/src/api/MicCheck.Api/Features/FeatureSegmentService.cs
@@ -4,7 +4,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Features;

-public class FeatureSegmentService(MicCheckDbContext db)
+public class FeatureSegmentService(IMicCheckDbContext db)
 {
    public async Task<IReadOnlyList<FeatureSegmentResponse>> ListByFeatureAsync(
        int featureId, int environmentId, CancellationToken ct = default)
--- a/src/api/MicCheck.Api/Features/FeatureService.cs
+++ b/src/api/MicCheck.Api/Features/FeatureService.cs
@@ -6,7 +6,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Features;

-public class FeatureService(MicCheckDbContext db, AuditService auditService, WebhookQueue webhookQueue)
+public class FeatureService(IMicCheckDbContext db, IAuditService auditService, WebhookQueue webhookQueue)
 {
    private const int MaxFeaturesPerProject = 400;

@@ -23,13 +23,7 @@ public class FeatureService(MicCheckDbContext db, AuditService auditService, Web
        return await db.Features.Include(f => f.Tags).FirstOrDefaultAsync(f => f.Id == id, ct);
    }

-    public async Task<Feature> CreateAsync(
-        int projectId,
-        string name,
-        FeatureType type,
-        string? initialValue,
-        string? description,
-        CancellationToken ct = default)
+    public async Task<Feature> CreateAsync(int projectId, string name, FeatureType type, string? initialValue, string? description, CancellationToken ct = default)
    {
        var count = await db.Features.CountAsync(f => f.ProjectId == projectId, ct);
        if (count >= MaxFeaturesPerProject)
@@ -78,8 +72,7 @@ public class FeatureService(MicCheckDbContext db, AuditService auditService, Web
        return feature;
    }

-    public async Task<Feature> UpdateAsync(
-        int id, string name, string? description, CancellationToken ct = default)
+    public async Task<Feature> UpdateAsync(int id, string name, string? description, CancellationToken ct = default)
    {
        var feature = await db.Features.Include(f => f.Tags).FirstOrDefaultAsync(f => f.Id == id, ct)
            ?? throw new KeyNotFoundException($"Feature {id} not found.");
@@ -162,11 +155,7 @@ public class FeatureService(MicCheckDbContext db, AuditService auditService, Web
                    EventType = WebhookEventTypes.FlagDeleted,
                    EnvironmentId = env.Id,
                    OrganizationId = project.OrganizationId,
-                    Data = new FlagDeletedData(
-                        null,
-                        DateTimeOffset.UtcNow,
-                        new FeatureSummary(feature.Id, feature.Name))
-                });
+                    Data = new FlagDeletedData(null, DateTimeOffset.UtcNow, new FeatureSummary(feature.Id, feature.Name)) });
            }
        }
    }
--- a/src/api/MicCheck.Api/Features/FeatureStateResult.cs
+++ b/src/api/MicCheck.Api/Features/FeatureStateResult.cs
@@ -1,6 +1,6 @@
 namespace MicCheck.Api.Features;

-public class FeatureStateResult
+public record FeatureStateResult
 {
    public required Feature Feature { get; init; }
    public bool Enabled { get; init; }
--- a/src/api/MicCheck.Api/Features/FeatureStateService.cs
+++ b/src/api/MicCheck.Api/Features/FeatureStateService.cs
@@ -5,7 +5,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Features;

-public class FeatureStateService(MicCheckDbContext db, WebhookQueue webhookQueue, AuditService auditService)
+public class FeatureStateService(IMicCheckDbContext db, WebhookQueue webhookQueue, IAuditService auditService)
 {
    public async Task<IReadOnlyList<FeatureState>> ListByEnvironmentAsync(int environmentId, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Features/FeatureUsageDaily.cs
+++ b/src/api/MicCheck.Api/Features/FeatureUsageDaily.cs
@@ -1,12 +0,0 @@
-namespace MicCheck.Api.Features;
-
-public class FeatureUsageDaily
-{
-    public int Id { get; init; }
-    public int EnvironmentId { get; init; }
-    public int FeatureId { get; init; }
-    public required string FeatureName { get; set; }
-    public DateOnly UsageDate { get; init; }
-    public long Count { get; set; }
-    public DateTimeOffset UpdatedAt { get; set; }
-}
--- a/src/api/MicCheck.Api/Features/FlagCache.cs
+++ b/src/api/MicCheck.Api/Features/FlagCache.cs
@@ -12,11 +12,9 @@ public class FlagCache(IMemoryCache cache)
        return flags;
    }

-    public void Set(int environmentId, IReadOnlyList<FeatureStateResult> flags)
-        => cache.Set(CacheKey(environmentId), flags, CacheDuration);
+    public void Set(int environmentId, IReadOnlyList<FeatureStateResult> flags) => cache.Set(CacheKey(environmentId), flags, CacheDuration);

-    public void Invalidate(int environmentId)
-        => cache.Remove(CacheKey(environmentId));
+    public void Invalidate(int environmentId) => cache.Remove(CacheKey(environmentId));

    private static string CacheKey(int environmentId) => $"flags:{environmentId}";
 }
--- a/src/api/MicCheck.Api/Features/Tag.cs
+++ b/src/api/MicCheck.Api/Features/Tag.cs
@@ -1,9 +1,9 @@
 namespace MicCheck.Api.Features;

-public class Tag
+public record Tag
 {
    public int Id { get; init; }
-    public required string Label { get; set; }
-    public required string Color { get; set; }
+    public required string Label { get; init; }
+    public required string Color { get; init; }
    public int ProjectId { get; init; }
 }
--- a/src/api/MicCheck.Api/Features/TagService.cs
+++ b/src/api/MicCheck.Api/Features/TagService.cs
@@ -3,7 +3,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Features;

-public class TagService(MicCheckDbContext db)
+public class TagService(IMicCheckDbContext db)
 {
    public async Task<IReadOnlyList<Tag>> ListByProjectAsync(int projectId, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Features/TagsController.cs
+++ b/src/api/MicCheck.Api/Features/TagsController.cs
@@ -8,23 +8,24 @@ namespace MicCheck.Api.Features;
 [ApiController]
 [Authorize(Policy = AuthorizationPolicies.AdminApiAccess)]
 [EnableRateLimiting("AdminApi")]
+[Route("api/v1/project/{projectId}")]
 public class TagsController(TagService tagService) : ControllerBase
 {
-    [HttpGet("api/v1/project/{projectId}/tags")]
+    [HttpGet("tags")]
    public async Task<ActionResult<IReadOnlyList<TagResponse>>> List(int projectId, CancellationToken ct)
    {
        var tags = await tagService.ListByProjectAsync(projectId, ct);
        return Ok(tags.Select(TagResponse.From).ToList());
    }

-    [HttpPost("api/v1/project/{projectId}/tags")]
+    [HttpPost("tags")]
    public async Task<ActionResult<TagResponse>> Create(int projectId, CreateTagRequest request, CancellationToken ct)
    {
        var tag = await tagService.CreateAsync(projectId, request.Label, request.Color, ct);
        return CreatedAtAction(nameof(List), new { projectId }, TagResponse.From(tag));
    }

-    [HttpDelete("api/v1/project/{projectId}/tag/{id}")]
+    [HttpDelete("tag/{id}")]
    public async Task<IActionResult> Delete(int projectId, int id, CancellationToken ct)
    {
        var tag = await tagService.FindByIdAsync(id, ct);
--- a/src/api/MicCheck.Api/Features/UpdateFeatureRequest.cs
+++ b/src/api/MicCheck.Api/Features/UpdateFeatureRequest.cs
@@ -1,20 +1,25 @@
-using FluentValidation;
+using System.Text.RegularExpressions;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Features;

-public record UpdateFeatureRequest(
-    string Name,
-    string? Description
-);
+public record UpdateFeatureRequest(string Name, string? Description);

-public class UpdateFeatureRequestValidator : AbstractValidator<UpdateFeatureRequest>
+public class UpdateFeatureRequestValidator : IModelValidator<UpdateFeatureRequest>
 {
-    public UpdateFeatureRequestValidator()
+    private static readonly Regex NamePattern = new("^[a-zA-Z0-9_-]+$");
+
+    public ValidationResult Validate(UpdateFeatureRequest model)
    {
-        RuleFor(x => x.Name)
-            .NotEmpty()
-            .MaximumLength(150)
-            .Matches("^[a-zA-Z0-9_-]+$")
-            .WithMessage("Name may only contain letters, digits, underscores, and hyphens.");
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 150)
+            result.AddError(nameof(model.Name), "'Name' must be 150 characters or fewer.");
+        else if (!NamePattern.IsMatch(model.Name))
+            result.AddError(nameof(model.Name), "Name may only contain letters, digits, underscores, and hyphens.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Features/Usage/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Features/Usage/DependencyRegistration.cs
@@ -0,0 +1,13 @@
+namespace MicCheck.Api.Features.Usage;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddFeatureUsageServices(this IServiceCollection services)
+    {
+        services.AddSingleton<FeatureUsageMetrics>();
+        services.AddScoped<FeatureUsageQueryService>();
+        services.AddHostedService<FeatureUsageFlushBackgroundService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageBucketKey.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageBucketKey.cs
@@ -1,3 +1,3 @@
-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

 public record struct FeatureUsageBucketKey(int EnvironmentId, int FeatureId, string FeatureName, DateOnly UsageDate);
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageController.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageController.cs
@@ -4,7 +4,7 @@ using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.Extensions.Caching.Memory;

-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

 [ApiController]
 [Route("api/v1/environment/{environmentId}/usage")]
@@ -13,10 +13,7 @@ namespace MicCheck.Api.Features;
 public class FeatureUsageController(FeatureUsageQueryService queryService, IMemoryCache cache) : ControllerBase
 {
    [HttpGet]
-    public async Task<ActionResult<DashboardUsageResponse>> GetDashboardUsage(
-        int environmentId,
-        [FromQuery] int days = 14,
-        CancellationToken ct = default)
+    public async Task<ActionResult<DashboardUsageResponse>> GetDashboardUsage(int environmentId, [FromQuery] int days = 14, CancellationToken ct = default)
    {
        days = Math.Clamp(days, 1, 90);
        var cacheKey = $"usage-dashboard:{environmentId}:{days}";
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageDaily.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageDaily.cs
@@ -0,0 +1,12 @@
+namespace MicCheck.Api.Features.Usage;
+
+public record FeatureUsageDaily
+{
+    public int Id { get; init; }
+    public int EnvironmentId { get; init; }
+    public int FeatureId { get; init; }
+    public required string FeatureName { get; init; }
+    public DateOnly UsageDate { get; init; }
+    public long Count { get; init; }
+    public DateTimeOffset UpdatedAt { get; init; }
+}
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageFlushBackgroundService.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageFlushBackgroundService.cs
@@ -1,8 +1,10 @@
+using System.Diagnostics.CodeAnalysis;
 using MicCheck.Api.Data;
 using Microsoft.EntityFrameworkCore;

-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

+[ExcludeFromCodeCoverage(Justification = "Timer-driven BackgroundService that issues raw SQL through a DI-scoped concrete MicCheckDbContext; exercising it cleanly requires a live DB, which CLAUDE.md disallows (no WebApplicationFactory/InMemory). DrainAccumulated's bucketing logic is covered by FeatureUsageMetricsTests.")]
 public class FeatureUsageFlushBackgroundService(
    FeatureUsageMetrics metrics,
    IServiceScopeFactory scopeFactory,
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageMetrics.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageMetrics.cs
@@ -1,7 +1,7 @@
 using System.Collections.Concurrent;
 using System.Diagnostics.Metrics;

-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

 public class FeatureUsageMetrics : IDisposable
 {
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageQueryService.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageQueryService.cs
@@ -1,9 +1,9 @@
 using MicCheck.Api.Data;
 using Microsoft.EntityFrameworkCore;

-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

-public class FeatureUsageQueryService(MicCheckDbContext db)
+public class FeatureUsageQueryService(IMicCheckDbContext db)
 {
    public async Task<DashboardUsageResponse> GetDashboardUsageAsync(int environmentId, int days, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Features/Usage/FeatureUsageResponses.cs
+++ b/src/api/MicCheck.Api/Features/Usage/FeatureUsageResponses.cs
@@ -1,9 +1,7 @@
-namespace MicCheck.Api.Features;
+namespace MicCheck.Api.Features.Usage;

 public record TopFeatureUsage(int FeatureId, string FeatureName, long Count);

 public record DailyUsage(DateOnly Date, long TotalCount, IReadOnlyList<TopFeatureUsage> Features);

-public record DashboardUsageResponse(
-    IReadOnlyList<TopFeatureUsage> TopFeaturesLastDay,
-    IReadOnlyList<DailyUsage> DailyUsage);
+public record DashboardUsageResponse(IReadOnlyList<TopFeatureUsage> TopFeaturesLastDay, IReadOnlyList<DailyUsage> DailyUsage);
--- a/src/api/MicCheck.Api/Identities/AdminIdentityService.cs
+++ b/src/api/MicCheck.Api/Identities/AdminIdentityService.cs
@@ -1,12 +1,13 @@
+using MicCheck.Api.Common;
 using MicCheck.Api.Data;
 using MicCheck.Api.Features;
 using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Identities;

-public class AdminIdentityService(MicCheckDbContext db)
+public class AdminIdentityService(IMicCheckDbContext db)
 {
-    public async Task<(int Total, IReadOnlyList<Identity> Items)> ListAsync(
+    public async Task<PagedResult<Identity>> ListAsync(
        int environmentId, int page, int pageSize, CancellationToken ct = default)
    {
        var query = db.Identities
@@ -20,7 +21,7 @@ public class AdminIdentityService(MicCheckDbContext db)
            .Take(pageSize)
            .ToListAsync(ct);

-        return (total, items);
+        return new PagedResult<Identity>(total, items);
    }

    public async Task<Identity?> CreateAsync(int environmentId, string identifier, CancellationToken ct = default)
--- a/src/api/MicCheck.Api/Identities/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Identities/DependencyRegistration.cs
@@ -0,0 +1,12 @@
+namespace MicCheck.Api.Identities;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddIdentitiesServices(this IServiceCollection services)
+    {
+        services.AddScoped<IdentityResolutionService>();
+        services.AddScoped<AdminIdentityService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Identities/IdentityResolutionService.cs
+++ b/src/api/MicCheck.Api/Identities/IdentityResolutionService.cs
@@ -3,7 +3,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Identities;

-public class IdentityResolutionService(MicCheckDbContext db)
+public class IdentityResolutionService(IMicCheckDbContext db)
 {
    public async Task<Identity> ResolveAsync(
        int environmentId,
--- a/src/api/MicCheck.Api/MicCheck.Api.csproj
+++ b/src/api/MicCheck.Api/MicCheck.Api.csproj
@@ -9,7 +9,6 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="FluentValidation.AspNetCore" Version="11.3.0" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.5" />
    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.5" />
    <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
--- a/src/api/MicCheck.Api/Migrations/20260617194113_AddFeatureUsageDaily.Designer.cs
+++ b/src/api/MicCheck.Api/Migrations/20260617194113_AddFeatureUsageDaily.Designer.cs
@@ -305,7 +305,7 @@ namespace MicCheck.Api.Migrations
                    b.ToTable("FeatureStates");
                });

-            modelBuilder.Entity("MicCheck.Api.Features.FeatureUsageDaily", b =>
+            modelBuilder.Entity("MicCheck.Api.Features.Usage.FeatureUsageDaily", b =>
                {
                    b.Property<int>("Id")
                        .ValueGeneratedOnAdd()
--- a/src/api/MicCheck.Api/Migrations/MicCheckDbContextModelSnapshot.cs
+++ b/src/api/MicCheck.Api/Migrations/MicCheckDbContextModelSnapshot.cs
@@ -302,7 +302,7 @@ namespace MicCheck.Api.Migrations
                    b.ToTable("FeatureStates");
                });

-            modelBuilder.Entity("MicCheck.Api.Features.FeatureUsageDaily", b =>
+            modelBuilder.Entity("MicCheck.Api.Features.Usage.FeatureUsageDaily", b =>
                {
                    b.Property<int>("Id")
                        .ValueGeneratedOnAdd()
--- a/src/api/MicCheck.Api/Organizations/CreateOrganizationRequest.cs
+++ b/src/api/MicCheck.Api/Organizations/CreateOrganizationRequest.cs
@@ -1,13 +1,20 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Organizations;

 public record CreateOrganizationRequest(string Name);

-public class CreateOrganizationRequestValidator : AbstractValidator<CreateOrganizationRequest>
+public class CreateOrganizationRequestValidator : IModelValidator<CreateOrganizationRequest>
 {
-    public CreateOrganizationRequestValidator()
+    public ValidationResult Validate(CreateOrganizationRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Organizations/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Organizations/DependencyRegistration.cs
@@ -0,0 +1,11 @@
+namespace MicCheck.Api.Organizations;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddOrganizationsServices(this IServiceCollection services)
+    {
+        services.AddScoped<OrganizationService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Organizations/InviteUserRequest.cs
+++ b/src/api/MicCheck.Api/Organizations/InviteUserRequest.cs
@@ -1,15 +1,23 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Organizations;

 public record InviteUserRequest(int UserId, string Role);

-public class InviteUserRequestValidator : AbstractValidator<InviteUserRequest>
+public class InviteUserRequestValidator : IModelValidator<InviteUserRequest>
 {
-    public InviteUserRequestValidator()
+    public ValidationResult Validate(InviteUserRequest model)
    {
-        RuleFor(x => x.UserId).GreaterThan(0);
-        RuleFor(x => x.Role).NotEmpty().Must(r => Enum.TryParse<OrganizationRole>(r, true, out _))
-            .WithMessage("Role must be 'User' or 'Admin'.");
+        var result = new ValidationResult();
+
+        if (model.UserId <= 0)
+            result.AddError(nameof(model.UserId), "'User Id' must be greater than 0.");
+
+        if (string.IsNullOrEmpty(model.Role))
+            result.AddError(nameof(model.Role), "'Role' must not be empty.");
+        else if (!Enum.TryParse<OrganizationRole>(model.Role, true, out _))
+            result.AddError(nameof(model.Role), "Role must be 'User' or 'Admin'.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Organizations/OrganizationService.cs
+++ b/src/api/MicCheck.Api/Organizations/OrganizationService.cs
@@ -1,10 +1,11 @@
+using System.Diagnostics.CodeAnalysis;
 using MicCheck.Api.Audit;
 using MicCheck.Api.Data;
 using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Organizations;

-public class OrganizationService(MicCheckDbContext db, AuditService auditService)
+public class OrganizationService(IMicCheckDbContext db, IAuditService auditService)
 {
    public async Task<IReadOnlyList<(Organization Org, bool IsPrimary)>> ListForUserAsync(int userId, CancellationToken ct = default)
    {
@@ -46,6 +47,7 @@ public class OrganizationService(MicCheckDbContext db, AuditService auditService
        return org;
    }

+    [ExcludeFromCodeCoverage(Justification = "ExecuteUpdateAsync requires a real EF Core relational query provider; our Mock<DbSet<T>> LINQ-to-Objects provider can't execute it, and CLAUDE.md disallows the EF InMemory provider as a substitute. The not-a-member early-return branch is covered by OrganizationServiceTests.")]
    public async Task SetPrimaryAsync(int organizationId, int userId, CancellationToken ct = default)
    {
        var member = await db.OrganizationUsers
--- a/src/api/MicCheck.Api/Organizations/UpdateOrganizationRequest.cs
+++ b/src/api/MicCheck.Api/Organizations/UpdateOrganizationRequest.cs
@@ -1,13 +1,20 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Organizations;

 public record UpdateOrganizationRequest(string Name);

-public class UpdateOrganizationRequestValidator : AbstractValidator<UpdateOrganizationRequest>
+public class UpdateOrganizationRequestValidator : IModelValidator<UpdateOrganizationRequest>
 {
-    public UpdateOrganizationRequestValidator()
+    public ValidationResult Validate(UpdateOrganizationRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Program.cs
+++ b/src/api/MicCheck.Api/Program.cs
@@ -1,11 +1,9 @@
-using System.Text;
 using System.Threading.RateLimiting;
-using FluentValidation;
-using FluentValidation.AspNetCore;
-using MicCheck.Api.Common.Security.ApiKeys;
 using MicCheck.Api.Audit;
-using MicCheck.Api.Common.Security.Authentication;
+using MicCheck.Api.Common;
+using MicCheck.Api.Common.Security.ApiKeys;
 using MicCheck.Api.Common.Security.Authorization;
+using MicCheck.Api.Common.Validation;
 using MicCheck.Api.Data;
 using MicCheck.Api.Environments;
 using MicCheck.Api.Features;
@@ -15,14 +13,7 @@ using MicCheck.Api.Projects;
 using MicCheck.Api.Segments;
 using MicCheck.Api.Users;
 using MicCheck.Api.Webhooks;
-using Microsoft.AspNetCore.Authentication;
-using Microsoft.AspNetCore.Authentication.JwtBearer;
-using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.Identity;
-using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.IdentityModel.Tokens;
 using Scalar.AspNetCore;
 using Serilog;

@@ -42,44 +33,12 @@ try
              .WriteTo.Console());

    builder.Services.AddOpenApi();
-    builder.Services.AddControllers()
+    builder.Services.AddControllers(options => options.Filters.Add<ModelValidationActionFilter>())
        .AddJsonOptions(options =>
            options.JsonSerializerOptions.Converters.Add(
                new System.Text.Json.Serialization.JsonStringEnumConverter()));

-    builder.Services.AddAuthentication()
-        .AddScheme<AuthenticationSchemeOptions, EnvironmentKeyAuthenticationHandler>(
-            EnvironmentKeyAuthenticationHandler.SchemeName, _ => { })
-        .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
-            ApiKeyAuthenticationHandler.SchemeName, _ => { })
-        .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
-        {
-            options.TokenValidationParameters = new TokenValidationParameters
-            {
-                ValidateIssuer = true,
-                ValidateAudience = true,
-                ValidateIssuerSigningKey = true,
-                ValidIssuer = builder.Configuration["Jwt:Issuer"],
-                ValidAudience = builder.Configuration["Jwt:Audience"],
-                IssuerSigningKey = new SymmetricSecurityKey(
-                    Encoding.UTF8.GetBytes(builder.Configuration["Jwt:SecretKey"]!))
-            };
-        });
-
-    builder.Services.AddAuthorization(options =>
-    {
-        options.AddPolicy(AuthorizationPolicies.FlagsApiAccess, policy =>
-            policy.AddAuthenticationSchemes(EnvironmentKeyAuthenticationHandler.SchemeName)
-                  .RequireClaim("EnvironmentId"));
-
-        options.AddPolicy(AuthorizationPolicies.AdminApiAccess, policy =>
-            policy.AddAuthenticationSchemes(ApiKeyAuthenticationHandler.SchemeName, JwtBearerDefaults.AuthenticationScheme)
-                  .RequireAuthenticatedUser());
-
-        options.AddPolicy(AuthorizationPolicies.OrganizationAdmin, policy =>
-            policy.AddAuthenticationSchemes(ApiKeyAuthenticationHandler.SchemeName, JwtBearerDefaults.AuthenticationScheme)
-                  .RequireClaim("OrganizationRole", "Admin"));
-    });
+    builder.Services.AddCommonServices(builder.Configuration);

    builder.Services.AddHttpContextAccessor();

@@ -92,66 +51,20 @@ try
            limiter.QueueLimit = 0;
        }));

-    builder.Services.AddFluentValidationAutoValidation();
-    builder.Services.AddValidatorsFromAssemblyContaining<Program>();
-
-    builder.Services.Configure<ApiBehaviorOptions>(options =>
-    {
-        options.InvalidModelStateResponseFactory = context =>
-        {
-            var errors = context.ModelState
-                .Where(e => e.Value?.Errors.Count > 0)
-                .ToDictionary(
-                    kvp => kvp.Key,
-                    kvp => kvp.Value!.Errors.Select(e => e.ErrorMessage).ToArray());
-            return new UnprocessableEntityObjectResult(new { errors });
-        };
-    });
-
    builder.Services.AddMemoryCache();
    builder.Services.AddMetrics();

-    builder.Services.AddScoped<ITokenService, TokenService>();
-    builder.Services.AddScoped<AuthService>();
-    builder.Services.AddScoped<ApiKeyService>();
-    builder.Services.AddScoped<DatabaseSeeder>();
-    builder.Services.AddScoped<IPasswordHasher<User>, PasswordHasher<User>>();
-    builder.Services.AddScoped<IAuthorizationHandler, ProjectPermissionRequirementHandler>();
-    builder.Services.AddScoped<FeatureEvaluationService>();
-    builder.Services.AddScoped<IdentityResolutionService>();
-    builder.Services.AddScoped<EnvironmentDocumentService>();
-    builder.Services.AddSingleton<SegmentEvaluator>();
-    builder.Services.AddSingleton<FlagCache>();
-    builder.Services.AddScoped<AuditService>();
-    builder.Services.AddScoped<AuditLogQueryService>();
-    builder.Services.AddScoped<OrganizationService>();
-    builder.Services.AddScoped<ProjectService>();
-    builder.Services.AddScoped<EnvironmentService>();
-    builder.Services.AddScoped<FeatureService>();
-    builder.Services.AddScoped<FeatureStateService>();
-    builder.Services.AddScoped<FeatureSegmentService>();
-    builder.Services.AddScoped<SegmentService>();
-    builder.Services.AddScoped<TagService>();
-    builder.Services.AddScoped<WebhookService>();
-    builder.Services.AddScoped<WebhookDispatcher>();
-    builder.Services.AddScoped<AdminIdentityService>();
-    builder.Services.AddScoped<UserService>();
-    builder.Services.AddSingleton<WebhookQueue>();
-    builder.Services.AddHostedService<WebhookBackgroundService>();
-    builder.Services.AddHostedService<WebhookRetryBackgroundService>();
-    builder.Services.AddSingleton<FeatureUsageMetrics>();
-    builder.Services.AddScoped<FeatureUsageQueryService>();
-    builder.Services.AddHostedService<FeatureUsageFlushBackgroundService>();
-    builder.Services.AddHttpClient("Webhooks", client =>
-        client.DefaultRequestHeaders.Add("User-Agent", "MicCheck-Webhook/1.0"));
+    builder.Services.AddAuditServices();
+    builder.Services.AddIdentitiesServices();
+    builder.Services.AddEnvironmentsServices();
+    builder.Services.AddSegmentsServices();
+    builder.Services.AddOrganizationsServices();
+    builder.Services.AddProjectsServices();
+    builder.Services.AddFeaturesServices();
+    builder.Services.AddUsersServices();
+    builder.Services.AddWebhooksServices();

-    var connectionString = builder.Configuration.GetConnectionString("miccheck")
-        ?? (System.Environment.GetEnvironmentVariable("DATABASE_URL") is { } databaseUrl
-            ? DatabaseUrlParser.ToNpgsqlConnectionString(databaseUrl)
-            : builder.Configuration.GetConnectionString("DefaultConnection")!);
-
-    builder.Services.AddDbContext<MicCheckDbContext>(options =>
-        options.UseNpgsql(connectionString));
+    builder.Services.AddDataServices(builder.Configuration);

    var app = builder.Build();

--- a/src/api/MicCheck.Api/Projects/.gitkeep
+++ b/src/api/MicCheck.Api/Projects/.gitkeep
--- a/src/api/MicCheck.Api/Projects/CreateProjectRequest.cs
+++ b/src/api/MicCheck.Api/Projects/CreateProjectRequest.cs
@@ -1,14 +1,23 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Projects;

 public record CreateProjectRequest(string Name, int OrganizationId);

-public class CreateProjectRequestValidator : AbstractValidator<CreateProjectRequest>
+public class CreateProjectRequestValidator : IModelValidator<CreateProjectRequest>
 {
-    public CreateProjectRequestValidator()
+    public ValidationResult Validate(CreateProjectRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
-        RuleFor(x => x.OrganizationId).GreaterThan(0);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        if (model.OrganizationId <= 0)
+            result.AddError(nameof(model.OrganizationId), "'Organization Id' must be greater than 0.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Projects/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Projects/DependencyRegistration.cs
@@ -0,0 +1,11 @@
+namespace MicCheck.Api.Projects;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddProjectsServices(this IServiceCollection services)
+    {
+        services.AddScoped<ProjectService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Projects/ProjectService.cs
+++ b/src/api/MicCheck.Api/Projects/ProjectService.cs
@@ -5,7 +5,7 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Projects;

-public class ProjectService(MicCheckDbContext db, AuditService auditService)
+public class ProjectService(IMicCheckDbContext db, IAuditService auditService)
 {
    public async Task<IReadOnlyList<Project>> ListByOrganizationAsync(int organizationId, CancellationToken ct = default)
    {
--- a/src/api/MicCheck.Api/Projects/SetUserPermissionsRequest.cs
+++ b/src/api/MicCheck.Api/Projects/SetUserPermissionsRequest.cs
@@ -1,17 +1,25 @@
-using FluentValidation;
 using MicCheck.Api.Common.Security.Authorization;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Projects;

 public record SetUserPermissionsRequest(int UserId, bool IsAdmin, List<string> Permissions);

-public class SetUserPermissionsRequestValidator : AbstractValidator<SetUserPermissionsRequest>
+public class SetUserPermissionsRequestValidator : IModelValidator<SetUserPermissionsRequest>
 {
-    public SetUserPermissionsRequestValidator()
+    public ValidationResult Validate(SetUserPermissionsRequest model)
    {
-        RuleFor(x => x.UserId).GreaterThan(0);
-        RuleForEach(x => x.Permissions)
-            .Must(p => Enum.TryParse<ProjectPermission>(p, true, out _))
-            .WithMessage("Invalid permission value.");
+        var result = new ValidationResult();
+
+        if (model.UserId <= 0)
+            result.AddError(nameof(model.UserId), "'User Id' must be greater than 0.");
+
+        foreach (var permission in model.Permissions)
+        {
+            if (!Enum.TryParse<ProjectPermission>(permission, true, out _))
+                result.AddError(nameof(model.Permissions), "Invalid permission value.");
+        }
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Projects/UpdateProjectRequest.cs
+++ b/src/api/MicCheck.Api/Projects/UpdateProjectRequest.cs
@@ -1,13 +1,20 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Projects;

 public record UpdateProjectRequest(string Name, bool HideDisabledFlags);

-public class UpdateProjectRequestValidator : AbstractValidator<UpdateProjectRequest>
+public class UpdateProjectRequestValidator : IModelValidator<UpdateProjectRequest>
 {
-    public UpdateProjectRequestValidator()
+    public ValidationResult Validate(UpdateProjectRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Segments/CreateSegmentRequest.cs
+++ b/src/api/MicCheck.Api/Segments/CreateSegmentRequest.cs
@@ -1,4 +1,4 @@
-using FluentValidation;
+using MicCheck.Api.Common.Validation;

 namespace MicCheck.Api.Segments;

@@ -16,24 +16,38 @@ public record CreateSegmentRequest(
    string Name,
    IReadOnlyList<CreateSegmentRuleRequest> Rules);

-public class CreateSegmentRequestValidator : AbstractValidator<CreateSegmentRequest>
+public class CreateSegmentRequestValidator : IModelValidator<CreateSegmentRequest>
 {
-    public CreateSegmentRequestValidator()
+    public ValidationResult Validate(CreateSegmentRequest model)
    {
-        RuleFor(x => x.Name).NotEmpty().MaximumLength(200);
-        RuleFor(x => x.Rules).NotNull();
-        RuleForEach(x => x.Rules).ChildRules(rule =>
+        var result = new ValidationResult();
+
+        if (string.IsNullOrEmpty(model.Name))
+            result.AddError(nameof(model.Name), "'Name' must not be empty.");
+        else if (model.Name.Length > 200)
+            result.AddError(nameof(model.Name), "'Name' must be 200 characters or fewer.");
+
+        if (model.Rules is null)
        {
-            rule.RuleFor(r => r.Type)
-                .Must(t => Enum.TryParse<SegmentRuleType>(t, true, out _))
-                .WithMessage("Rule type must be 'All', 'Any', or 'None'.");
-            rule.RuleForEach(r => r.Conditions).ChildRules(cond =>
+            result.AddError(nameof(model.Rules), "'Rules' must not be empty.");
+            return result;
+        }
+
+        foreach (var rule in model.Rules)
        {
-                cond.RuleFor(c => c.Property).NotEmpty();
-                cond.RuleFor(c => c.Operator)
-                    .Must(o => Enum.TryParse<SegmentConditionOperator>(o, true, out _))
-                    .WithMessage("Invalid operator.");
-            });
-        });
+            if (!Enum.TryParse<SegmentRuleType>(rule.Type, true, out _))
+                result.AddError(nameof(model.Rules), "Rule type must be 'All', 'Any', or 'None'.");
+
+            foreach (var condition in rule.Conditions)
+            {
+                if (string.IsNullOrEmpty(condition.Property))
+                    result.AddError(nameof(model.Rules), "'Property' must not be empty.");
+
+                if (!Enum.TryParse<SegmentConditionOperator>(condition.Operator, true, out _))
+                    result.AddError(nameof(model.Rules), "Invalid operator.");
+            }
+        }
+
+        return result;
    }
 }
--- a/src/api/MicCheck.Api/Segments/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Segments/DependencyRegistration.cs
@@ -0,0 +1,12 @@
+namespace MicCheck.Api.Segments;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddSegmentsServices(this IServiceCollection services)
+    {
+        services.AddSingleton<SegmentEvaluator>();
+        services.AddScoped<SegmentService>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Segments/SegmentService.cs
+++ b/src/api/MicCheck.Api/Segments/SegmentService.cs
@@ -9,7 +9,7 @@ public record SegmentConditionDefinition(string Property, SegmentConditionOperat

 public record SegmentRuleDefinition(SegmentRuleType Type, IReadOnlyList<SegmentConditionDefinition> Conditions, IReadOnlyList<SegmentRuleDefinition>? ChildRules = null);

-public class SegmentService(MicCheckDbContext db, AuditService auditService)
+public class SegmentService(IMicCheckDbContext db, IAuditService auditService)
 {
    private const int MaxSegmentsPerProject = 100;
    private const int MaxConditionsPerSegment = 100;
--- a/src/api/MicCheck.Api/Users/DependencyRegistration.cs
+++ b/src/api/MicCheck.Api/Users/DependencyRegistration.cs
@@ -0,0 +1,14 @@
+using Microsoft.AspNetCore.Identity;
+
+namespace MicCheck.Api.Users;
+
+public static class DependencyRegistration
+{
+    public static IServiceCollection AddUsersServices(this IServiceCollection services)
+    {
+        services.AddScoped<UserService>();
+        services.AddScoped<IPasswordHasher<User>, PasswordHasher<User>>();
+
+        return services;
+    }
+}
--- a/src/api/MicCheck.Api/Users/UserService.cs
+++ b/src/api/MicCheck.Api/Users/UserService.cs
@@ -4,28 +4,28 @@ using Microsoft.EntityFrameworkCore;

 namespace MicCheck.Api.Users;

-public class UserService(MicCheckDbContext db, IPasswordHasher<User> passwordHasher)
+public class UserService(IMicCheckDbContext db, IPasswordHasher<User> passwordHasher)
 {
    public async Task<User?> FindByIdAsync(int userId, CancellationToken ct = default) =>
        await db.Users.FirstOrDefaultAsync(u => u.Id == userId && u.IsActive, ct);

-    public async Task<(User? User, bool EmailConflict)> UpdateProfileAsync(
+    public async Task<ProfileUpdateResult> UpdateProfileAsync(
        int userId, string firstName, string lastName, string email, CancellationToken ct = default)
    {
        var user = await db.Users.FirstOrDefaultAsync(u => u.Id == userId && u.IsActive, ct);
-        if (user is null) return (null, false);
+        if (user is null) return new ProfileUpdateResult(null, EmailConflict: false);

        if (!string.Equals(user.Email, email, StringComparison.OrdinalIgnoreCase))
        {
            var emailTaken = await db.Users.AnyAsync(u => u.Email == email && u.Id != userId, ct);
-            if (emailTaken) return (null, true);
+            if (emailTaken) return new ProfileUpdateResult(null, EmailConflict: true);
        }

        user.FirstName = firstName;
        user.LastName = lastName;
        user.Email = email;
        await db.SaveChangesAsync(ct);
-        return (user, false);
+        return new ProfileUpdateResult(user, EmailConflict: false);
    }

    public async Task<bool> ChangePasswordAsync(
@@ -42,3 +42,5 @@ public class UserService(MicCheckDbContext db, IPasswordHasher<User> passwordHas
        return true;
    }
 }
+
+public record ProfileUpdateResult(User? User, bool EmailConflict);
--- a/src/api/MicCheck.Api/Users/UsersController.cs
+++ b/src/api/MicCheck.Api/Users/UsersController.cs
@@ -39,11 +39,11 @@ public class UsersController(UserService userService) : ControllerBase
            string.IsNullOrWhiteSpace(request.Email))
            return BadRequest("First name, last name, and email are required.");

-        var (user, emailConflict) = await userService.UpdateProfileAsync(
+        var result = await userService.UpdateProfileAsync(
            userId.Value, request.FirstName.Trim(), request.LastName.Trim(), request.Email.Trim(), ct);

-        if (emailConflict) return Conflict("Email is already in use.");
-        return user is null ? NotFound() : Ok(UserResponse.From(user));
+        if (result.EmailConflict) return Conflict("Email is already in use.");
+        return result.User is null ? NotFound() : Ok(UserResponse.From(result.User));
    }

    [HttpPost("me/change-password")]
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
James Wampler	8262cd2f61	Drop docker-compose from dev workflow; run full build/test and Aspire locally All checks were successful CI / build-and-push (push) Successful in 46s Details CI / deploy-qa (push) Successful in 12s Details CI / smoke-qa (push) Successful in 26s Details dev-build.sh now builds the whole solution and runs .NET + Jest unit tests instead of restarting docker-compose services. readme documents the aspire run command for local orchestration; slnx solution-items reference to the removed docker-compose.yml is gone.	2026-07-06 10:44:11 -07:00
James Wampler	83441b6c69	Removing old docker-compose file. Use Aspire instead All checks were successful CI / build-and-push (push) Successful in 51s Details CI / deploy-qa (push) Successful in 12s Details CI / smoke-qa (push) Successful in 22s Details	2026-07-06 10:33:02 -07:00
James Wampler	283ca4f148	Move QA Postgres password out of docker-compose into Gitea secret Follows the same pattern already used for JWT_SECRET_KEY: interpolated from a required env var, sourced from a Gitea Actions secret in CI.	2026-07-06 10:32:04 -07:00
James Wampler	7a3e2167c2	Remove FluentValidation; validator/DI cleanup (#7 ) All checks were successful CI / build-and-push (push) Successful in 1m0s Details CI / deploy-qa (push) Successful in 11s Details CI / smoke-qa (push) Successful in 26s Details ## Summary - Remove FluentValidation dependency; replace with plain IModelValidator<T>/ValidationResult pattern (ported from BuyEngine's Guard/validation approach), wired via a ModelValidationActionFilter - Move FeatureUsage code into MicCheck.Api.Features.Usage namespace - Convert logic-free data classes to records per CLAUDE.md (WebhookEvent, FeatureStateResult, ProjectPermissionRequirement, AuditLog, Tag, FeatureUsageDaily) - Extract IAuditService interface, drop virtual-method mock seam on AuditService - Split Program.cs DI registrations into per-namespace DependencyRegistration classes ## Test plan - [x] dotnet build (API + tests) clean - [x] dotnet test MicCheck.Api.Tests.Unit — 646/646 passing - [x] pre-push hook (full solution build/test + admin build) passed Co-authored-by: miccheck-ci <ci@miccheck.local> Reviewed-on: #7	2026-07-05 22:54:30 -07:00
James Wampler	127aefc020	Fix npm audit vulnerabilities in admin (form-data high, js-yaml moderate) All checks were successful CI / build-and-push (push) Successful in 1m0s Details CI / deploy-qa (push) Successful in 15s Details CI / smoke-qa (push) Successful in 30s Details Both are transitive (axios->form-data, babel-jest->js-yaml); npm audit fix bumped them non-breaking, package.json unchanged. Full jest suite still green (306/306).	2026-07-05 16:14:33 -07:00
miccheck-ci	9d445aca67	chore: refresh coverage badge [skip ci]	2026-07-05 22:08:11 +00:00
James Wampler	87113ccdcd	Add unit tests for Environments, Audit, and Webhooks namespaces (#6 ) All checks were successful CI / build-and-push (push) Successful in 54s Details CI / deploy-qa (push) Successful in 12s Details CI / smoke-qa (push) Successful in 24s Details ## Summary - Add missing unit test coverage for the Environments, Audit, and Webhooks namespaces (raises them from ~0-62% to 91-100%) - Exclude WebhookBackgroundService/WebhookRetryBackgroundService from coverage (require live DI/DB, disallowed by CLAUDE.md's no-InMemory/WebApplicationFactory rule) ## Test plan - [x] `dotnet test` full suite passes (646/646) - [x] Coverage report confirms Environments ~99.5%, Audit 100%, Webhooks ~91% Reviewed-on: #6	2026-07-05 15:07:26 -07:00
James Wampler	cae55e5737	Add coverage reporting/badges and split CI between Gitea and GitHub (#5 ) All checks were successful CI / build-and-push (push) Successful in 46s Details CI / deploy-qa (push) Successful in 13s Details CI / smoke-qa (push) Successful in 35s Details Merge dotnet+jest coverage via reportgenerator, publish a self-hosted coverage badge and build-status badges on the readme. Gitea remains the full pipeline (build/test/docker push/deploy-qa/smoke); GitHub only builds and tests since it has no registry secrets or qa runner. Reviewed-on: #5	2026-07-05 10:14:30 -07:00
James Wampler	20188c61a2	Refactor nunit tests off InMemory/WebApplicationFactory, remove tuple returns (#4 ) All checks were successful CI / build-and-push (push) Successful in 48s Details CI / deploy-qa (push) Successful in 12s Details CI / smoke-qa (push) Successful in 20s Details ## Summary - Extract `IMicCheckDbContext` and mock DB access with Moq instead of the EF InMemory provider, per CLAUDE.md testing guidelines. - Rewrite HTTP-pipeline tests to exercise controllers/auth handlers directly instead of `WebApplicationFactory`. - Remove tuple return types across the API in favor of named records (`PagedResult<T>`, `ProfileUpdateResult`, `ApiKeyCreationResult`). ## Test plan - [x] `dotnet build` (full solution) - [x] `dotnet test tests/api/MicCheck.Api.Tests.Unit` — 187/187 pass - [x] `dotnet test tests/api/MicCheck.Api.Tests.Integration` — 8/8 pass (live API + Postgres via Aspire) - [x] Verified Aspire AppHost/dashboard starts and API responds Reviewed-on: #4	2026-07-04 21:40:47 -07:00
James Wampler	1556b486d2	Fix CI build/deploy/smoke pipeline for the self-hosted qa runner (#3 ) All checks were successful CI / build-and-push (push) Successful in 39s Details CI / deploy-qa (push) Successful in 12s Details CI / smoke-qa (push) Successful in 18s Details ## Summary - Fix a chain of QA CI issues: Docker build/health-check flakiness, NuGet vuln pins, then adds the post-deploy integration + Playwright smoke suite and works through everything needed to make it actually run on the self-hosted `qa` runner (musl/Alpine job container, no node/dotnet/curl preinstalled, docker-outside-of-docker networking). - Adds a fixed dev/QA seed admin user + fixed Development environment API key so integration tests and e2e specs have a stable target. - Pins Aspire's `AppHost.cs` ports/credentials to match the docker-compose local dev defaults. - Adds `tests/api/MicCheck.Api.Tests.Integration` coverage for disabled flags, environment-document bootstrap, identity override precedence, auth login, and unauthorized access; adds a Playwright e2e suite under `src/admin/e2e` (login, nav, context selection, features CRUD/toggle). - Adds a `smoke-qa` CI job that runs both suites against the just-deployed QA stack, working around: no curl/node/dotnet on the bare runner, musl vs glibc (Playwright browsers run via the official `mcr.microsoft.com/playwright` image instead), and the runner's job-container network isolation (reach the QA stack via the docker bridge gateway IP; `docker cp` instead of a bind mount to get files into the playwright container, since paths don't cross the docker-outside-of-docker boundary). ## Test plan - [x] Unit tests pass (dotnet test tests/api/MicCheck.Api.Tests.Unit, 243 passed) - [x] API integration suite passes against the real QA stack in CI - [x] Playwright e2e suite passes against the real QA stack in CI (verified 3/3 locally against a real dev API + vite server for the flakiest spec) - [x] Full CI pipeline (build → deploy-qa → smoke-qa) green end to end on the qa runner Reviewed-on: #3	2026-07-04 18:53:05 -07:00