Add CMS track delete: DeepDrftContent DELETE endpoint, DeepDrftWeb SQL-first orchestration, DeepDrftCms confirmation dialog (W3-T3)

DeepDrftWeb/Startup.cs

@@ -7,6 +7,13 @@ namespace DeepDrftWeb;
 
 public static class Startup
 {
+    /// <summary>
+    /// Named HttpClient used by CMS controllers to call DeepDrftContent's ApiKey-protected endpoints.
+    /// Distinct from the public WASM-facing "DeepDrft.Content" client so the API key never reaches
+    /// the browser. Configured server-side only.
+    /// </summary>
+    public const string ContentCmsHttpClientName = "DeepDrft.Content.Cms";
+
     public static void ConfigureDomainServices(WebApplicationBuilder builder)
     {
         // Add Entity Framework services
@@ -18,11 +25,24 @@ public static class Startup
         builder.Services
             .AddHttpContextAccessor()
             .AddScoped<DarkModeService>();
-        
+
         // Add Track services
         builder.Services
             .AddScoped<TrackRepository>()
             .AddScoped<ITrackService, TrackService>();
+
+        // CMS → DeepDrftContent client. The API key is required up front (no lazy resolution)
+        // so a misconfiguration surfaces at startup instead of on the first delete attempt.
+        var contentApiUrl = builder.Configuration["ApiUrls:ContentApi"]
+            ?? throw new InvalidOperationException("ApiUrls:ContentApi is required");
+        var contentApiKey = builder.Configuration["DeepDrftContent:ApiKey"]
+            ?? throw new InvalidOperationException("DeepDrftContent:ApiKey is required (see environment/apikey.json)");
+
+        builder.Services.AddHttpClient(ContentCmsHttpClientName, client =>
+        {
+            client.BaseAddress = new Uri(contentApiUrl);
+            client.DefaultRequestHeaders.Add("ApiKey", contentApiKey);
+        });
     }
     
     public static string GetKestrelUrl(this WebApplicationBuilder builder)