Capstone: the shelter service

Start the shelter service from almost nothing: settings from .env, a health check, and the cats API with every rule a client can break checked at the door: validated bodies, refused unknown properties, numeric ids, and 404s that say what was missing.

Move the cats into a database without changing a single response, then add adoptions: a second table related to the first, and an adoption that marks the cat and records itself in one transaction, rolled back whole when a rule refuses it.

Give the shelter its people: accounts with hashed passwords in the database, sign-in with a JWT, a guard in front of every route with a few marked public, staff-only changes to the cats, adoptions made as whoever is signed in, and the database's own refusals turned into answers a client can use.

Get the service ready for strangers: responses serialized so an entity's secrets cannot leak, a rate limit on everything and a tight one on sign-in, helmet's security headers, and CORS for the shelter's own front end and nobody else's.

Make the service readable and watchable: an OpenAPI document that says which routes need a token and what every body looks like, and adoptions announced to every connected screen the moment they are committed, and never when they are rolled back.

Prove the service works the way a client meets it: end-to-end tests that boot the whole application, sign in as staff and as an adopter, and check the rules that matter, so that each of four realistic regressions fails at least one test.