⭐ Identity.API

In progress. .csproj, GlobalUsings.cs, a placeholder Program.cs, Models, Configuration, Data, and 5 of 6 Quickstart areas (Home/Grants/Diagnostics/Consent/Device) are done. Account/External and Services/*/the real Program.cs remain.

Identity.API is Duende IdentityServer — the OIDC/OAuth provider the whole system authenticates against, backed by ASP.NET Core Identity and EF Core. Much larger than every project migrated so far (a full app: Duende's Quickstart UI, EF Core migrations — not a small library), so a few scoping decisions got made up front:

• 22 files confirmed dead, excluded from the migration: Models/AccountViewModels/ConsentViewModels/ManageViewModels/ErrorViewModel.cs — leftovers from an older ASP.NET Core Identity UI scaffold, superseded by Duende's own Quickstart/Account/Quickstart/Consent/Quickstart/Home. Confirmed via a real repo-wide grep against the upstream snapshot — zero references anywhere outside each file's own namespace declaration.
• The Quickstart UI is being converted straight to a JSON API, not added as Razor UI first — a 2026-08-24 pivot. The original plan was to add Duende's server-rendered Quickstart scaffold as-is and convert it once Identity.WebApp (decided 2026-08-20) started consuming it; that got reversed to avoid doing the work twice. Every Quickstart controller returns ActionResult<T>/Ok(...) instead of View(...) — no Razor views or wwwroot assets added at all. Anti-forgery ([ValidateAntiForgeryToken], tied to server-rendered forms) is dropped from every converted action, a known, deliberately deferred gap to revisit once Identity.WebApp's real deployment topology is known.
• A real Duende.IdentityServer.EntityFramework.Storage version conflict got found and fixed trying to restore this project for the first time (NU1109 package downgrade — pinned below what a sibling package required). All 4 Duende.IdentityServer.* packages are now unified under one central version variable instead of mismatched hardcoded pins.
• Program.cs is a placeholder, not reviewed — Microsoft.NET.Sdk.Web needs a Main method to build at all, a real structural difference from every plain class-library project added so far. Gets replaced with the real, fully-reviewed version later in this project's normal migration order.

Tracked via real GitHub Issues with native parent/child linking: #10 "Identity.API" (parent) with #11 "Identity.WebApp" (child) — the React frontend is dependent work under this project, not a peer.

Full detail and commit hashes in todo.md's Identity.API section.