Adds portal-frontend as a new service (no published port, only
reachable via the proxy, same as new-frontend) and two nginx location
blocks for /portal - a bare-path redirect plus the prefix-stripping
proxy_pass. The existing /, /legacy, and /api/ blocks are unchanged.
Verified end to end: /portal/, a deep link, and / all return 200
through the single published proxy port, and /api/worklist still
returns the full 17-item worklist.
Builds the four-seam, three-write-path reference demo backend: case-framework
(seam D stand-in), legacy-backend/frontend (SQL Server, seams A/B/C targets),
and new-backend (Domain/Application/Infrastructure.*/Api implementing the
source resolver, take/release-ownership, write-through translator, and owned
assessment flow), wired together via docker-compose with a plain placeholder
frontend standing in for the Angular portal until Session 2.
All 11 Architecture.Tests pass and scripts/smoke.sh passes end-to-end against
a fresh `docker compose up`, covering acceptance criteria 1-3 and 7-22.
Fixes two real domain bugs found only once the stack ran for real: the BSN
eleven-proof checksum trivially passes all-zero digits, and the adoption
mapper silently treated a partial legacy address as absent instead of failing
loudly. Also fixes several environment-specific integration issues (rootless
Podman/SELinux bind-mount permissions, a buildah NuGet layer-caching bug,
SqlClient's invariant-globalization incompatibility, and an nginx path-prefix
mismatch for the legacy frontend).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
eho
