Program.cs

using FluentValidation;
using GroundShareAPI.Extensions;
using GroundShareAPI.Filters;
using Serilog;

// ---------------------------------------------------------------------------
// Serilog bootstrap logger — captures errors during host building. The final,
// config-driven logger is wired up by AddSerilogLogging() once the host exists.
// ---------------------------------------------------------------------------
Log.Logger = new LoggerConfiguration()
    .WriteTo.Console()
    .CreateBootstrapLogger();

try
{
    var builder = WebApplication.CreateBuilder(args);

    // Configuration sources.
    builder.Configuration.AddKeyVaultIfConfigured();

    // Logging.
    builder.Host.AddSerilogLogging();

    // MVC + validation + API explorer.
    // Scans this assembly for AbstractValidator<T> classes; the ValidationFilter
    // resolves them per request and throws our ValidationException (mapped to the
    // ApiResponse<object> shape by the exception middleware).
    builder.Services.AddValidatorsFromAssemblyContaining<Program>();
    builder.Services.AddControllers(options =>
    {
        options.Filters.Add<ValidationFilter>();
    })
    .AddJsonOptions(options =>
    {
        // Every DateTime leaves the API as UTC with an explicit "Z" suffix —
        // see UtcDateTimeJsonConverter for why (SQL rows arrive Kind=Unspecified
        // and would otherwise serialize suffix-less, which browsers parse as
        // local time).
        options.JsonSerializerOptions.Converters.Add(new UtcDateTimeJsonConverter());
        options.JsonSerializerOptions.Converters.Add(new UtcNullableDateTimeJsonConverter());
    });
    builder.Services.AddEndpointsApiExplorer();
    builder.Services.AddSwaggerGen();

    // Response compression. Kestrel on Linux App Service has no IIS dynamic
    // compression module in front of it, so without this every JSON body — the
    // GeoJSON building footprints especially — goes over the wire raw.
    builder.Services.AddResponseCompressionForApi();

    // HTTP clients (default proxy client + legacy-TLS "iplan" client).
    builder.Services.AddAppHttpClients();

    // Data, services, jobs, storage, options.
    builder.Services.AddDataAccessLayer();
    builder.Services.AddApplicationServices();
    builder.Services.AddBackgroundJobs();
    builder.Services.AddBlobStorage(builder.Configuration);
    builder.Services.AddAppOptions(builder.Configuration);

    // Security: JWT auth, CORS, rate limiting.
    builder.Services.AddJwtAuthentication(builder.Configuration, builder.Environment);
    builder.Services.AddConfiguredCors(builder.Configuration);
    builder.Services.AddAppRateLimiting(builder.Environment);

    var app = builder.Build();

    app.ConfigureRequestPipeline();

    app.Run();
}
catch (Exception ex)
{
    Log.Fatal(ex, "Application terminated unexpectedly");
}
finally
{
    Log.CloseAndFlush();
}