.NET Web API taste

# .NET Web API taste of a pragmatic C# backend engineer - Target the latest LTS release of .NET and turn on nullable reference types and warnings as errors in every project. Confidence: 0.90 - Use minimal APIs with grouped route builders for small services, and controllers only when a large team already knows them well. Confidence: 0.75 - Organize code by feature folders such as Orders or Billing instead of global Controllers, Services and Repositories folders. Confidence: 0.80 - Bind settings to strongly typed options classes with the options pattern and validate them at startup with ValidateOnStart. Confidence: 0.90 - Keep secrets out of appsettings.json and read them from user secrets locally and a vault or environment variables in production. Confidence: 0.95 - Register dependencies with the built-in container and keep lifetimes explicit, never injecting a scoped service into a singleton. Confidence: 0.90 - Accept a CancellationToken in every async endpoint and pass it all the way down to database and HTTP calls. Confidence: 0.90 - Never block on async code with .Result or .Wait(), and use async all the way through the call stack. Confidence: 0.95 - Use EF Core with AsNoTracking for read-only queries and project straight to DTOs with Select instead of loading full entities. Confidence: 0.85 - Manage schema changes with EF Core migrations checked into the repo and applied by a separate deploy step, not at app startup. Confidence: 0.80 - Keep request and response DTOs separate from EF entities so the database schema never leaks into the public API. Confidence: 0.90 - Validate input with FluentValidation or data annotations and return RFC 7807 problem details for every error. Confidence: 0.85 - Handle unexpected exceptions in one global exception handler instead of try/catch blocks in every endpoint. Confidence: 0.85 - Create outgoing HTTP clients through IHttpClientFactory with typed clients and resilience policies for retries and timeouts. Confidence: 0.90 - Log with structured message templates through ILogger, never with string interpolation inside log calls. Confidence: 0.85 - Export traces, metrics and logs with OpenTelemetry and expose separate liveness and readiness health check endpoints. Confidence: 0.80 - Publish an OpenAPI document from the code and generate typed clients from it instead of hand-writing them. Confidence: 0.75 - Use JWT bearer authentication with policy-based authorization rather than role string checks scattered through handlers. Confidence: 0.85 - Write integration tests with WebApplicationFactory against a real database in Testcontainers, not an in-memory provider. Confidence: 0.85 - Keep unit tests fast with xUnit and test behavior through public APIs instead of mocking every internal class. Confidence: 0.75 - Build small container images with the official SDK and runtime images and run the app as a non-root user. Confidence: 0.85 - Pin package versions centrally with Directory.Packages.props so every project in the solution uses the same versions. Confidence: 0.80