feat: build local Nexora E2E foundation with SQL bootstrap

[hakodev2k]

Current handoff — code-only local Release 1 continuation

PR #4 remains open and unmerged on impl/m01-s00-scaffold targeting main.

• Current branch head: 99db64e2ab07a202ddd4fde1d5ce2b756879a2d8 (handoff documentation commit).
• Code implementation commit: e42516e2360ad2afd7d8a0144412a15086770983.
• Latest implementation CI evidence revision: a3a0a7b84a124a8a9063d35d65641119e2824718; commits after it are documentation-only.
• Authority: DEC-20260909-014 permits slice-by-slice local implementation. Production deployment, public launch, real providers/OAuth/secrets/user data, paid services and external destructive actions remain disabled.
• This PR description does not claim full R1 completion, acceptance, SQL runtime verification or production readiness.

Read the continuation handoff first when resuming.

Completed blocker and contract fixes

• API and Bootstrap Release builds now pass with warnings-as-errors; no warnings were disabled and no project was removed from CI.
• SQL Identity password reset loads enabled MFA from [identity].[MfaCredential]; MFA-enabled reset fails closed as MfaRecoveryRequired before password, security-stamp or session mutation.
• Frontend apiFetch captures X-CSRF-Token from every successful response, preserving login CSRF rotation for the next mutation.
• Developer Toolbox sends UUID Idempotency-Key through the existing JSON mutation headers; global CSRF/idempotency filters remain enabled.
• Module catalog gate marks only locally implemented slices Ready/SystemEnabled/RegistrationEnabled; deliberately unimplemented modules are disabled and FX30/FX34/FX35 remain Paused/provider-gated.
• SELF authorization preserves the User own-resource baseline for Admin/SuperAdmin when a module is enabled; administrative/cross-user/support permissions remain separate.
• /health/live is process-only; /health/ready requires SQL, migration journal, required migrations through 0020, and bootstrap/security invariant, with coarse non-secret failure responses.
• Idempotency UUID fallback, request-size metadata, separate required NEXORA_IDEMPOTENCY_SECRET, account/security NOLOCK removal and stale catalog wording were hardened.
• FX11–FX13 source alignment covers title/description bounds, project A–Z ordering, time-bound confirmations, terminal read-only rules, Task Overdue, one-way Task → Calendar projection, Task projection direct-edit denial and Calendar Day/Week/Month/Agenda selectors.
• Documents creation requires explicit DocumentType/EditorMode and exposes Grid/Table selection.
• Migrations 20260910_0019_productivity_contract_alignment.sql and 20260910_0020_task_calendar_projection.sql are included.

Traceability and evidence

• R1 requirement traceability matrix
• Local E2E status
• Productivity contract alignment
• Continuation handoff
• Existing manual QA script

The matrix distinguishes documented catalog, locally implemented, runtime-available, partial, not implemented, blocked, paused and not-run evidence. Documentation/action contracts are not runtime proof.

Verification

Pass

• GitHub Actions Nexora local implementation checks, run 34508111597 / run 149, passed:
  • bash scripts/dev/verify.sh
  • dotnet build src/Nexora.Api/Nexora.Api.csproj --configuration Release
  • dotnet build src/Nexora.Bootstrap/Nexora.Bootstrap.csproj --configuration Release
  • dotnet run --project tests/Nexora.UnitTests/Nexora.UnitTests.csproj --configuration Release — 24 tests, 0 failed
  • npm ci --prefix web/Nexora.Web
  • npm run build --prefix web/Nexora.Web
• Agent baseline workflow run 34508111463 / run 166: Pass.
• Local API Release build: Pass, 0 warnings, 0 errors.
• Local Bootstrap Release build: Pass, 0 warnings, 0 errors.
• Local frontend production build: Pass.
• Local git diff --check: Pass.

Not run / not claimed

• Local bash scripts/dev/verify.sh: Not run because Windows WSL/Bash creation returned E_ACCESSDENIED; CI command passed.
• SQL Server integration/migration execution, NEXORA_TEST_SQL_CONNECTION, readiness runtime and SQL isolation/lifecycle checks: Not run.
• Browser/manual CSRF rotation, Developer Toolbox idempotency, owner-isolation/lifecycle QA and independent security review: Not run under the repository code-only amendment. The manual flow is documented for the human owner.
• No new automated tests, fixtures, demo records or provider/runtime data were added.

Remaining status

The matrix remains Partial, Not implemented, Blocked, Paused or Not run for many committed R1 areas. Sharing/support/emergency, files/import-export/backup, reminders/planner/habits/time tracking/Pomodoro, advanced document hierarchy/import-export/version restore, advanced finance/Vault, News/shopping/GitHub/monitoring/assets/career/learning and other vertical slices still require contracted implementation. FX30/FX34/FX35 remain provider-gated. FX11–FX13 still need SQL/browser evidence and remaining ICS, DST/all-day and aggregate-restore coverage.

Do not label this PR “R1 complete”, “Accepted”, “Runtime verified” or production-ready. Do not merge PR #4 in this continuation.