Merge Web and API into unified deployment for simplified operations

[Copilot]

Consolidates SecureBootDashboard.Web and SecureBootDashboard.Api into single application to reduce deployment complexity and infrastructure costs in small-to-medium environments (1-1000 devices).

Architecture

Before: Separate Web (7001) and API (5001) applications requiring independent deployment and configuration.

After: Unified application on port 7001 serving both UI and REST endpoints. Razor Pages call API controllers via localhost HTTP.

┌─────────────────────────────────┐
│  SecureBootDashboard.Web (7001) │
│                                 │
│  Razor Pages ──localhost──► API │
│  (Dashboard)              (REST)│
│       └──────┬──────────────┘   │
│         Shared Services         │
└─────────────────────────────────┘

Implementation

Merged Components

• Controllers: 14 API controllers → Web project
• Services: 13 business logic services → Web project
• Data: DbContext, entities, 15 migrations → Web project
• Infrastructure: SignalR hub, background services, storage → Web project
• Configuration: Consolidated into single appsettings.json

Program.cs

Unified startup (888 LOC) combines:

• API: Controllers, Swagger, SignalR, EF Core, background services, rate limiting, caching, compression
• Web: Razor Pages, authentication (EntraId/Windows/Anonymous)
• Middleware ordered: compression → CORS → routing → auth → endpoints

HTTP Client Configuration

Web pages access API via loopback:

builder.Services.AddHttpClient<ISecureBootApiClient, SecureBootApiClient>()
    .ConfigurePrimaryHttpMessageHandler(/* localhost SSL bypass for dev */);

builder.Services.Configure<ApiSettings>(options => 
    options.BaseUrl = "https://localhost:7001");

Existing Razor Pages unchanged - continue using ISecureBootApiClient abstraction.

Endpoints

Path	Function
/	Dashboard UI
/api/Devices	REST API
/api/SecureBootReports	Client submissions
/swagger	API docs (dev only)
/dashboardHub	SignalR
/health	Health check

Trade-offs

Gains: Single deployment, 50% lower hosting costs, simplified config/logs/monitoring

Constraints: Shared resource pool (CPU/memory), cannot scale Web/API independently

Separate deployment remains available for >1000 devices or specialized scaling requirements.

Backward Compatibility

• PowerShell clients: No changes required (API endpoints preserved at /api/*)
• Database: No schema changes
• Authentication: Same providers supported
• Configuration: Superset of previous settings

Documentation

• QUICKSTART_v1.14.md: Azure/IIS/Docker deployment
• docs/UNIFIED_DEPLOYMENT.md: Architecture, performance, migration

Original prompt

Implementiamo una soluzione che collassa l'applicazione web ve il servizio API sulla stessa web app evitando di fare il deployment di due applicazioni. Mi rendo conto che diventa meno scalable ma è più gestibile in ambienti meno esigenti

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.