⭐ eShop.ServiceDefaults

Done. All 7 source files reviewed — Aspire's shared telemetry/health-check/resilience defaults every service pulls in via AddServiceDefaults(). This pass went further than "does it compile," on the user's explicit direction: every finding either got fixed or explicitly tracked, not left as "verified, matches upstream."

Real fixes, not just version bumps:

• A security gap: TokenValidationParameters.ValidateAudience = false meant a token's aud claim was never actually checked, so a token issued for one downstream API could be replayed against any other API using this code. Removed the override.
• A hidden order-dependency: ClaimsPrincipalExtensions.GetUserId's "sub" claim lookup only worked because a different file removed "sub" from the framework's default claim-type map — nothing enforced that ordering. Now falls back to ClaimTypes.NameIdentifier regardless.
• Dead unreachable test-only code removed (HttpClientExtensions), a misleading comment rewritten, a magic AI-telemetry string traced to the real Microsoft.Extensions.AI assembly and extracted to a constant, inconsistent sentence-separator logic in OpenApiOptionsExtensions unified into one shared helper, and a descriptions[^1] "pick the last one" assumption replaced with MaxBy(d => d.ApiVersion) after confirming the provider's ordering isn't actually documented anywhere.

Full detail and commit hashes in todo.md's eShop.ServiceDefaults section. Also the first project with complete test coverage — all 7 source files, 33 passing tests — see Testing.