Refactor app architecture and clean local artifacts

README.md

@@ -32,13 +32,19 @@ The frontend uses a lightweight local session flow for development:
 
 ## Backend
 
-Update `Backend/appsettings.json` or set `VTSA_POSTGRES`, then:
+Development uses the same local PostgreSQL defaults as `docker-compose.dev.yml`:
+
+```text
+Host=localhost;Port=5433;Database=vtuber_star_awards_dev;Username=vtsa_dev;Password=change-me-local-only
+```
+
+Those defaults are already present in `Backend/appsettings.Development.json`. For other environments, keep `Backend/appsettings.json` empty and set `VTSA_POSTGRES` or `ConnectionStrings__Postgres`.
 
 ```bash
 cd Backend
 dotnet restore
 dotnet build
-dotnet run
+ASPNETCORE_ENVIRONMENT=Development dotnet run --urls http://127.0.0.1:5084
 ```
 
 ## Local Database
@@ -54,21 +60,23 @@ dotnet ef database update
 Default dev database:
 
 ```text
-Host=localhost;Port=5433;Database=vtuber_star_awards_dev;Username=postgres;Password=postgres
+Host=localhost;Port=5433;Database=vtuber_star_awards_dev;Username=vtsa_dev;Password=change-me-local-only
 ```
 
+Override `VTSA_DEV_POSTGRES_USER` and `VTSA_DEV_POSTGRES_PASSWORD` before starting Docker if you want different local credentials.
+
 If `dotnet ef database update` is unavailable in the current environment, the repository also contains a bootstrap SQL script:
 
 ```bash
 cd Backend
-psql "Host=localhost Port=5433 Database=vtuber_star_awards_dev Username=postgres Password=postgres" -f Migrations/InitialCreate.manual.sql
+psql "Host=localhost Port=5433 Database=vtuber_star_awards_dev Username=vtsa_dev Password=change-me-local-only" -f Migrations/InitialCreate.manual.sql
 ```
 
 Verify the runtime wiring:
 
 ```bash
-curl http://localhost:5084/api/health
-curl http://localhost:5084/api/health/database
+curl http://127.0.0.1:5084/api/health
+curl http://127.0.0.1:5084/api/health/database
 ```
 
 Development auth/session endpoints:
@@ -87,3 +95,18 @@ curl -X POST http://localhost:5084/api/auth/dev-login \
 - Database connectivity and pending migrations are exposed at `/api/health/database`
 - Current frontend store falls back to static seed-like data if the API is unavailable
 - The admin dashboard now includes a lightweight risk center and audit log for suspicious submit patterns and reviewed admin actions
+
+## Suggested Backend Rollout Phases
+
+1. Public participation core
+   - Home, nominations, voting, clip submission, winner archive
+   - Backend focus: overview/category/archive reads plus persisted user participation state
+2. Admin season setup
+   - Admin years, categories, candidates, season status
+   - Backend focus: season/category/candidate CRUD and current-year switching
+3. Review and moderation
+   - Admin reviews, nominations inbox, clips, risk center
+   - Backend focus: nomination approval/rejection, clip moderation states, risk resolution workflows
+4. Reporting and operations
+   - Admin dashboard, analytics, user logs, settings health checks
+   - Backend focus: richer aggregates, audit search/filtering, operational health endpoints