jobtrackingapp/docs/architecture/backend.md

Backend architecture

JobTrackerApi/ is the ASP.NET Core 9 host. Controllers expose /api endpoints, services contain domain orchestration, JobTrackerContext owns EF Core persistence and tenant filters, and hosted services handle scheduled or recoverable work.

The API supports local email/password accounts, Google and Microsoft identity sign-in where configured, cookie sessions with CSRF protection, Identity roles, TOTP two-factor authentication, session revocation, email verification/reset, rate limits, and admin-only system/audit surfaces.

The largest orchestration boundaries are JobApplicationsController, ProfileCvController, and StartupInitializationExtensions. They are recorded as conditional refactoring debt; file size alone is not a reason for a rewrite. See API reference, background jobs, and technical debt.