fleshout backend

README.md

@@ -23,8 +23,16 @@ The API runs at `http://localhost:5231`. Swagger UI is available in Development
 
 Skeleton endpoints:
 
-- `GET /health` — liveness check
+- `GET /health` — liveness check, exempt from rate limiting
 - `GET /v1/info` — app name, version, environment, and server timestamp
+- `GET|POST /v1/users`, `GET|PUT|DELETE /v1/users/{id}` — placeholder CRUD over the
+  in-memory repository
+
+Requests are rate limited per client IP using the `RateLimiting` section of
+`appsettings.json`, and allowed CORS origins come from the `Cors` section. Storage is
+selected by `Persistence:Provider`, which currently supports `InMemory` only; data is
+lost on restart until a real provider is registered in
+`backend/Data/PersistenceServiceCollectionExtensions.cs`.
 
 ## Frontend
 
@@ -46,7 +54,7 @@ VITE_API_BASE_URL=http://localhost:5231
 
 ## Running both
 
-Start the backend and frontend in separate terminals. The backend CORS policy allows requests from `http://localhost:3000`.
+Start the backend and frontend in separate terminals. The backend CORS policy allows requests from `http://localhost:3000` by default; change `Cors:AllowedOrigins` in `backend/appsettings.json` to add more.
 
 ## Project structure