Serve the site API from ASP.NET Core 10

The language website ran a Spring Boot application on JVM 25 for two
endpoints, and it was the only JVM on the server: a quarter of a
gigabyte of resident memory for /api/v1/site and /health. The server
already runs ASP.NET Core 10 for Progmaweb.

The API is now Progmasoft.Tala.Website.Api, a minimal ASP.NET Core 10
application under the namespace Progmasoft.Tala.Website. It answers as
before: /api/v1/site returns the site's own state as the same JSON,
POST is not allowed there, /health answers with an empty 200, and every
other path is 404. It listens on 127.0.0.1, port 5086 unless PORT says
otherwise, as the Spring process did, so Nginx is unchanged.

- Progmasoft.Tala.Website.slnx, Directory.Build.props and global.json
  set up the solution with warnings as errors, documentation comments
  required and NuGet lock files.
- Progmasoft.Tala.Website.Api.Tests runs the endpoints in an in-memory
  host with xUnit v3 on Microsoft.Testing.Platform.
- ops/systemd/tala-site-api.service runs the published DLL on the shared
  runtime from /srv/xsharp/website/current/site-api, with the hardening
  of the unit it replaces.
- CI builds, tests, publishes and reports coverage with dotnet; CodeQL
  analyzes C# instead of Kotlin; Renovate watches NuGet instead of
  Gradle.

6 files changed, 30 insertions, 34 deletions

diff --git a/.github/ISSUE_TEMPLATE/diagnostic.yml b/.github/ISSUE_TEMPLATE/diagnostic.yml
index 28e20e4..29be55f 100644
--- a/.github/ISSUE_TEMPLATE/diagnostic.yml
+++ b/.github/ISSUE_TEMPLATE/diagnostic.yml
@@ -13,7 +13,7 @@ body:
       label: Affected area
       options:
         - Vue website or page content
-        - Kotlin/Spring site API
+        - ASP.NET Core site API
         - Localization or theme
         - Routing, metadata, or indexing
         - Deployment or Nginx configuration
@@ -45,7 +45,7 @@ body:
     id: environment
     attributes:
       label: Environment
-      description: OS/browser, website commit, Node.js version, or Java 25 version when relevant.
+      description: OS/browser, website commit, Node.js version, or .NET 10 version when relevant.
     validations:
       required: true
   - type: textarea
diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
index 20ed569..90424aa 100644
--- a/.github/codeql/codeql-config.yml
+++ b/.github/codeql/codeql-config.yml
@@ -5,5 +5,6 @@ name: Tala website owned sources
 paths-ignore:
   - frontend/node_modules
   - frontend/dist
-  - backend/build
+  - backend/**/bin
+  - backend/**/obj
 
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 653c9c9..a90aac6 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -10,9 +10,9 @@ Describe the Tala website behavior or content changed. This repository is not th
 ## Verification
 
 - [ ] Frontend checks, tests, formatting, and build were run where relevant.
-- [ ] Kotlin/Spring tests were run where relevant.
+- [ ] ASP.NET Core tests were run where relevant.
 - [ ] en-US/de-DE, light/dark, accessibility, and small-screen behavior were considered for UI changes.
-- [ ] Internal links, forum availability messaging, and the legacy ViGet redirect were checked if affected.
+- [ ] Internal links, and forum availability messaging were checked if affected.
 - [ ] No credentials, generated output, or unrelated files are included.
 
 Commands and results (including anything not run):
diff --git a/.github/renovate.json5 b/.github/renovate.json5
index 6d8623b..78d6dc6 100644
--- a/.github/renovate.json5
+++ b/.github/renovate.json5
@@ -35,12 +35,12 @@
   ignorePaths: ["**/node_modules/**"],
 
   // What Dependabot watched here, and nothing more for now.
-  enabledManagers: ["github-actions", "npm", "gradle", "gradle-wrapper"],
+  enabledManagers: ["github-actions", "npm", "nuget"],
 
   // One pull request for each kind of dependency.
   packageRules: [
     { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
     { matchManagers: ["npm"], groupName: "Frontend packages" },
-    { matchManagers: ["gradle", "gradle-wrapper"], groupName: "Backend plugins and libraries" },
+    { matchManagers: ["nuget"], groupName: "Backend packages" },
   ],
 }
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70631c6..e1be3db 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,22 +54,21 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
         with:
-          distribution: temurin
-          java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-        with:
-          gradle-version: "9.6.0"
-          cache-provider: basic
-      # dokkaGenerate is the documentation gate: an undocumented public
-      # declaration or a broken reference fails the build.
-      - run: gradle test jacocoTestReport bootJar dokkaGenerate --no-daemon
-        working-directory: backend
+          dotnet-version: 10.0.x
+          cache: true
+          cache-dependency-path: "**/packages.lock.json"
+      # The build is the documentation gate: GenerateDocumentationFile with
+      # warnings as errors fails on a public declaration without its comment.
+      - run: dotnet restore Progmasoft.Tala.Website.slnx --locked-mode
+      - run: dotnet build Progmasoft.Tala.Website.slnx --configuration Release --no-restore
+      - run: dotnet test --project backend/Progmasoft.Tala.Website.Api.Tests/Progmasoft.Tala.Website.Api.Tests.csproj --configuration Release --no-build --coverlet --coverlet-output-format cobertura --results-directory TestResults
+      - run: dotnet publish backend/Progmasoft.Tala.Website.Api/Progmasoft.Tala.Website.Api.csproj --configuration Release --no-restore --output publish
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: website-backend-coverage
-          path: backend/build/reports/jacoco/test/jacocoTestReport.xml
+          path: TestResults/coverage.cobertura.xml
           if-no-files-found: error
           retention-days: 1
 
@@ -105,7 +104,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      # Keep OIDC-capable jobs isolated from Gradle build scripts.
+      # Keep OIDC-capable jobs isolated from the backend build.
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: website-backend-coverage
@@ -113,7 +112,7 @@ jobs:
       - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           use_oidc: true
-          files: coverage/backend/jacocoTestReport.xml
+          files: coverage/backend/coverage.cobertura.xml
           flags: website-backend
           fail_ci_if_error: true
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c5dde81..b565115 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,31 +25,27 @@ jobs:
             build_mode: none
           - language: javascript-typescript
             build_mode: none
-          - language: java-kotlin
+          - language: csharp
             build_mode: manual
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
-        if: matrix.language == 'java-kotlin'
+      - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+        if: matrix.language == 'csharp'
         with:
-          distribution: temurin
-          java-version: "25"
-      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-        if: matrix.language == 'java-kotlin'
-        with:
-          gradle-version: "9.6.0"
+          dotnet-version: 10.0.x
       - uses: github/codeql-action/init@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
           config-file: ./.github/codeql/codeql-config.yml
           queries: security-extended
-      - name: Build Kotlin backend for extraction
-        if: matrix.language == 'java-kotlin'
-        run: gradle classes --no-daemon
-        working-directory: backend
+      - name: Build the backend for extraction
+        if: matrix.language == 'csharp'
+        run: |
+          dotnet restore Progmasoft.Tala.Website.slnx --locked-mode
+          dotnet build Progmasoft.Tala.Website.slnx --configuration Release --no-restore
       - uses: github/codeql-action/analyze@7999b86c43a865dc79d8923397f35af22de63401 # v4
         with:
           category: /language:${{ matrix.language }}