A backend dev reported a dev-stage Go implementation - atomic reservation,
webhook idempotency, RBAC+audit, Argon2id+TOTP, PKCE, HMAC preview tokens,
ed25519 partner signing - in response to being handed this file. No repo
or host shared, so nothing is verified yet.
Logged six open questions, led by the two most urgent: does it own the
host behind tonight's CORS incident, and is the admin credentials
endpoint the frontend already calls actually built. Updated the file
header - "there is no backend yet" is stale.
916d142877