docs(backend): log dev backend report, request verification (§0b)

A backend dev reported a dev-stage Go implementation - atomic reservation,
webhook idempotency, RBAC+audit, Argon2id+TOTP, PKCE, HMAC preview tokens,
ed25519 partner signing - in response to being handed this file. No repo
or host shared, so nothing is verified yet.

Logged six open questions, led by the two most urgent: does it own the
host behind tonight's CORS incident, and is the admin credentials
endpoint the frontend already calls actually built. Updated the file
header - "there is no backend yet" is stale.

docs/backend/BACKEND-INTEGRATION.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-08-22 · **Branch of record:** `improvements/fork-harvest`
 
-This is the single source of truth for the marketplaces backend. It replaces the former `docs/backend/` set (Phase 1–10, Track A/S, the handoffs, the partner and harvest docs) — all of it is folded in here. The frontend is Angular 22, built and waiting; **there is no backend yet.** Everything below is the wire contract and the invariants the frontend needs, never DB schema or service boundaries, which stay the backend's own call.
+This is the single source of truth for the marketplaces backend. It replaces the former `docs/backend/` set (Phase 1–10, Track A/S, the handoffs, the partner and harvest docs) — all of it is folded in here. The frontend is Angular 22, built and waiting. **A backend now exists in dev form (reported 2026-08-27, §0b) but is not yet reachable from this repo or production** — treat every "not built" note below as "not confirmed reachable," not "definitely absent." Everything below is the wire contract and the invariants the frontend needs, never DB schema or service boundaries, which stay the backend's own call.
 
 > **The rule (keep this file alive).** When a backend need is added, a contract changes, or something ships, update THIS file in the same change — the relevant section and the change log at the bottom (§14). One file, always current. Do not create a new backend `.md`; add a section here.
 
@@ -12,6 +12,7 @@ This is the single source of truth for the marketplaces backend. It replaces the
 
 | § | Area | Was |
 |---|---|---|
+| 0b | Verification requested from backend (2026-08-27) | new |
 | 1 | System shape — multi-tenancy, auth, infra state | Handoff §1–4 |
 | 2 | Release invariants (the gate) | Handoff §0 |
 | 3 | How work lands — PR & release discipline | Handoff §0a |
@@ -31,6 +32,25 @@ New endpoints use `/api/v2/...`; legacy endpoints (documented in `../../BACKEND-
 
 ---
 
+## 0b. Verification requested from backend (2026-08-27)
+
+A backend dev reported the following as built, in response to being handed this file. Frontend can't verify any of it directly — **no repo link, host, or port has been shared yet.** Reply with those first; the questions below are what to confirm once we have access.
+
+**Reported as real (not stubs):** atomic stock reservation (single lock, not SELECT+UPDATE), webhook idempotency via insert-first, RBAC with tenant-scope check, audit on every mutation, Argon2id + TOTP (RFC 6238), PKCE for OAuth, HMAC-signed preview tokens, ed25519-signed partner requests, public order token instead of sequential ID.
+
+**Reported as a stub / needs our input:** no real DB yet — an in-memory `Store` (Go maps under `sync.RWMutex`), wiped on every restart; `oauthProviders` in `handler_auth.go` has real VK/Yandex URLs but empty `ClientID`/`ClientSecret` and no code-exchange; `hostingerApplyDNS()` is a stub; the payment-provider webhook secret is a hardcoded placeholder.
+
+**Ask, in priority order:**
+
+1. **§1.2 CORS / origin allowlist — not mentioned at all.** This is the thing actually broken in production right now: `users.vitanova.network:456/users/sessions` 403s every gorbushka origin (see the live incident above). Does this backend own that host? If not, where does it live?
+2. **§1.2 Admin login/password — `POST /api/identity/v1/session` — not mentioned.** The frontend already calls this contract (2026-08-26). Is it built?
+3. **Invariant 1 (§2) — tenant resolution from verified `Host` alone.** Not mentioned. Confirm no public endpoint accepts a `marketplaceId` from the browser.
+4. **Invariant 4 (§2) says idempotency must be "enforced by unique constraints, not handler logic."** "Insert into the in-memory map first" is handler logic by construction — there's no DB yet, so this can't literally hold today. Not a problem now, but flag that the bar is a real unique constraint once a DB exists, not just "duplicate insert returns an error."
+5. **Not mentioned at all — confirm in scope or not yet started:** money/FX server-side price computation (§5, Invariant 2), revision immutability/rollback/clone (§11, FH-2.7), server-side storefront config validation (§11, FH-2.10), digital goods code pools (§8, FH-2.11).
+6. **Invariant 5 (§2) / §4.4 encrypted credential envelope** — explicitly not done per their own report (webhook secret hardcoded, OAuth creds empty). Consistent, no new info needed, just tracked here so it isn't lost.
+
+---
+
 ## 1. System shape
 
 ### 1.1 Multi-tenancy — shapes every endpoint
@@ -440,6 +460,7 @@ Write: `POST /companies/{id}/projects`, `/projects/{id}/stores`, `/stores/{id}/p
 
 Append here whenever a section changes. Newest first.
 
+- **2026-08-27 (2)** — Added §0b: a backend dev reported a dev-stage Go backend implementing atomic reservation, webhook idempotency, RBAC+audit, Argon2id+TOTP, PKCE, HMAC preview tokens, and ed25519 partner signing, in response to being handed this file. No repo/host shared yet — nothing here is verified. Logged six open questions, led by the two most urgent: does it own the CORS-broken auth host, and is `POST /api/identity/v1/session` built. Updated the file header — "there is no backend yet" is no longer accurate; replaced with "not confirmed reachable."
 - **2026-08-27** — Enriched the 2026-08-26 CORS incident entry (§1.2) with detail pulled from `vitanovaPackages/BACKEND-TODO.md` (root-caused there 2026-08-24, more precise than this file's original note): confirmed it's an origin-allowlist gap specifically, not blanket CORS breakage (`novo.market` works, gorbushka doesn't), added the `X-Marketplace-Domain` header requirement and the `qr.vitanova.network` allowlist question. Also added the `Retry-After` rate-limit contract for admin credentials login and the ed25519 dead-export status — neither was in this file before. **Backend TODOs are not fully consolidated**: this file is canonical for the `marketplaces` repo per its own policy, but `vitanovaPackages/BACKEND-TODO.md` is a separate file in a separate repo and still holds the source-of-truth detail for package-level backend asks (this CORS finding, payment version-discipline, ed25519 status) — mirrored here, not merged away.
 - **2026-08-26** — Frontend now wires `POST /api/identity/v1/session` (§1.2 admin credential contract) from the admin login dialog, behind a "Войти по логину и паролю" toggle; every call 404s until the backend endpoint exists, surfaced to the user as one generic message, never the raw error. **Also found and logged a live incident** in the same section: the Telegram QR/session endpoint (`users.vitanova.network:456/users/sessions`) 403s every tested origin with no CORS headers at all — Telegram login, currently the only working admin auth path, is fully broken in production. Not a frontend fix; needs the backend CORS allowlist updated.
 - **2026-08-22** — Added `published: boolean` to the bootstrap response contract (§1.1): frontend now renders a built-in generic placeholder (all feature flags on) for any marketplace with no published revision, decided from this one field rather than HTTP status. See [Brand-bootstrap design](../superpowers/specs/2026-08-22-frontend-default-bootstrap-design.md).