I designed and implemented this as an end-to-end solo project, focusing on architecture quality, API ergonomics, and practical production concerns like request tracing, rate limiting, and compatibility-safe API versioning.

• > Implemented Clean Architecture boundaries across backend (`domain`, `application`, `infrastructure`, `presentation`) and frontend (`domain`, `application`, `infrastructure`, `presentation`) to keep business logic isolated from frameworks.
• > Shipped a complete authentication lifecycle with register, login, refresh, logout, email confirmation, resend confirmation, forgot password, and reset password flows.
• > Added token refresh via secure HTTP-only cookies and endpoint-level rate limiting for sensitive auth and reset operations.
• > Built URL management workflows for create, list, redirect, and delete, including ownership and expiration checks.
• > Exposed compatibility-safe route prefixes (`/api/v1` and legacy `/v1`) to support smooth frontend integration during migration/refactor phases.
• > Added Redis-backed global rate limiting and request ID middleware for better abuse protection and traceability.
• > Implemented QR code generation endpoints for shortened and custom URLs with PNG/SVG/JPEG output, configurable size/error correction, and cache-aware response headers.
• > Added broad integration journey coverage (auth, URL shortening, password reset, QR flows) and frontend contract validation tests to reduce backend/frontend drift.