The merged PR #84 left the backend build red on develop: WorkerLifecycleEventTests
referenced IUnitOfWork without importing Planora.BuildingBlocks.Domain.Interfaces
(CS0246). Add the using so 'dotnet build -warnaserror' passes.

The #84 Collaboration microservice extraction left CI and the security
scan red on develop. Four independent breakages are fixed here so every
gate is green again.

WHAT changed and WHY:
- TodoGrpcServiceTests: the gRPC service constructor gained
  ITodoRepository and IFriendshipService (for CheckTaskCommentAccess),
  but the test factory still passed the old two-arg shape (CS7036).
  Updated CreateService to supply default mocks for both dependencies.
- WorkerLifecycleEventTests: replaced Assert.True(.Any(...)) with
  Assert.Contains to satisfy the xUnit2012 analyzer promoted to error
  under -warnaserror.
- docs/database.md: a wrapped bullet line began with '+ shared-with',
  which markdownlint parsed as a plus-style list marker (MD004).
  Rewrapped so the continuation no longer starts with a list glyph.
- Collaboration Dockerfile: added --no-install-recommends to the
  apt-get install, matching every other service Dockerfile and clearing
  the Trivy IaC HIGH that blocked the security scan.

HOW verified: full backend build with -warnaserror, dotnet test (788
passed), markdownlint with the CI globs (0 errors), and the frontend
lint/type-check/test/build pipeline all pass locally. The CodeQL csharp
job failed only because autobuild hit the same CS7036 compile error, so
it recovers with the test fix.

Security: restores the Trivy IaC HIGH/CRITICAL gate to green
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…cher

The #84 Collaboration microservice extraction added a new service that the
local launcher never started, and the launcher carried four hand-maintained
port arrays that had already drifted from reality. This brings the launcher
in line with the current topology and makes its port handling impossible to
desync.

WHAT changed and WHY:
- Start collaboration-api: added it to $ServiceDefs at port 5060, placed
  after auth-api and todo-api because it is a gRPC client of both (Auth 5031,
  Todo 5101). It now builds, starts, health-checks, appears in the summary
  table, and is torn down with the rest.
- Single source of truth for ports: $ServiceRestPorts, $ServiceGrpcPorts,
  $AllPlanoraPorts, and $ShutdownOrder are now derived from $ServiceDefs.
  Stop-PlanoraProcesses and Invoke-GracefulShutdown use them, replacing four
  divergent literal arrays (which omitted 5060 and disagreed on gRPC ports).
- New -Stop switch: stops every process the launcher started and frees their
  ports without touching infrastructure containers or data volumes, reusing
  the existing graceful-shutdown path.
- New -Help switch: prints a concise usage block and exits before any side
  effect (no transcript/log file created).

HOW verified: the script parses cleanly via the PowerShell AST parser, and
both -Help and -Stop were run end-to-end (Stop exercises the derived port
lists and shutdown order and exits 0). README and getting-started.md document
the new flags; CHANGELOG records the change.

Security: -Stop deliberately skips loading .env, so no secrets enter the
process environment for a teardown-only invocation

UpdateCommentCommandValidator capped every comment edit at 2000 characters,
but a genesis comment (the task description) is allowed up to 5000 - both on
create and in the domain (Comment.UpdateGenesisContent). Because the validator
runs in the ValidationBehavior pipeline before the handler, editing a task
description to 2001-5000 characters was rejected with a 400, contradicting the
domain, docs/features.md, and the documented PUT behavior in docs/API.md.

The validator only receives the ids and content - it cannot tell a genesis
comment from a regular one - so it now enforces only the shared upper bound
(5000). The domain applies the exact per-kind limit (2000 regular via
Comment.UpdateContent, 5000 genesis via UpdateGenesisContent) and a violation
surfaces as a 400 (InvalidValueObjectException is ErrorCategory.Validation).

Added UpdateCommentCommandValidatorTests pinning the boundaries (accepts 3000
and 5000, rejects empty and 5001, requires TaskId and CommentId). The full
Collaboration suite passes (40 tests). docs/API.md and docs/features.md already
described the intended 5000 limit, so the code was the defect, not the docs.

Refs: #84

… live author identity

Removes a cross-service data-duplication bug class. The task description was
stored twice — TodoItem.Description (the card) and a 'genesis' comment in the
Collaboration DB (the branch) — synced only at creation via an async event. So
pre-Collaboration tasks had an empty branch, new tasks' descriptions lagged the
outbox cycle, and the two edit paths could diverge.

P1 — description = single source of truth (Todo):
- CheckTaskCommentAccess gRPC now returns the live description + task_created_at.
- GetCommentsQueryHandler synthesises the pinned 'Author's Note' from it on read
  (page 1 only; id = task id, author = owner) instead of reading a stored genesis.
  Instant, always matches the card, present for old tasks.
- TaskCreatedEventConsumer no longer materialises a genesis (only the 'created
  the task' system comment). Removed the POST /genesis endpoint, the
  AddGenesisComment command/handler/validator, and Comment.CreateGenesis /
  UpdateGenesisContent. The read query excludes any legacy genesis rows.
- Frontend edits the description on the task (PUT /todos) via a new
  onSaveDescription path in the edit modal; branch-feed no longer calls genesis
  endpoints. Removed the dead addGenesisComment API client function.

P2 — author identity resolved live:
- Comment.AuthorName was a stored copy of the Auth-owned name that went stale on
  rename. Added AuthService.GetUserProfilesBatch (name + avatar); Collaboration
  resolves comment + genesis author identity live (60 s cache via CachingUserService),
  keeping the stored name only as an offline fallback. IUserService is now
  profile-based (GetUserProfilesAsync) instead of avatar-only.

HOW verified: end-to-end on a live local stack — a task created with a description
returns the Author's Note on an immediate (0s) fetch with the author name resolved
live, and editing the description on the task reflects in the branch. Backend builds
under -warnaserror; 784 backend + 370 frontend tests pass on net10.0. Docs (API,
features, database, architecture) updated to the new model.

Refs: #84

Audit follow-ups (P1 + P2).

P1 - consumer idempotency (INV-COMM-4) was documented but not implemented.
RabbitMqEventBus delivers at-least-once (nack+requeue on failure), but nothing
deduped - the IdempotentMessageHandler/Inbox machinery was dead code, so a
redelivered or restart-replayed event produced duplicate system comments
(Collaboration) / notifications. The bus now dedups centrally on the stable
@event.Id via IInboxRepository: skip the handler when the id is already recorded,
record it after success. Graceful + defensive - a service with no inbox (or an
inbox error) falls back to the previous behaviour, never worse. Added an
InboxMessages table + repository to Collaboration (PK = event id); Realtime is a
follow-up. Also fixed the pre-existing bug where IdempotentMessageHandler checked
ExistsAsync against the PK while storing the id in MessageId (never matched) - the
new InboxMessage(Guid eventId,...) ctor makes the PK the event id.

P2 - AsNoTracking on CategoryApi reads. BaseRepository already does this for its
generic reads, but the custom CategoryRepository did not. Added it to the
read-only methods (list/get/paged); kept tracking on GetByIdAsync (load-then-update)
and FindAsync (also used for fetch-then-RemoveRange).

HOW verified: build clean under -warnaserror; 784 tests pass on net10.0; live
stack confirmed the inbox records the processed TaskCreatedIntegrationEvent and
exactly one 'created the task' system comment is produced. Docs (database.md,
features.md) updated; the Collaboration inbox table is created by EnsureCreated on
a fresh DB.

Refs: #84