feat(fp): WP-22 — durable persistence (SQLite/EF Core)

Applications, documents (+ audit log) and the brief move off static in-memory
Dictionaries onto a real SQLite file via EF Core, so demo data survives a
process restart or `docker compose restart api` for the first time. The three
stores (ApplicationStore/DocumentStore/BriefStore) keep their exact public
signatures and static-class shape — no DI, no async ripple into Program.cs's
minimal-API handlers — each method just opens a short-lived AppDbContext via
Db.Create() under the same lock it already had. Opaque nested shapes (a
wizard's draft snapshot, a brief's sections/placeholders/status) are stored as
JSON text columns rather than redesigned into relational tables, matching the
existing "don't interpret it" posture.

Found two things the WP's own text got wrong, corrected in
docs/backlog/WP-22-durable-persistence.md's Deviations section: SeedData never
seeded these three stores (only the read-only BRP/DUO-mimicking GETs, which
stay in-memory) so there's no seed step; and no new docker-compose volume is
needed since the existing bind mount already covers the SQLite file — verified
against this environment's real podman-backed compose stack, not just by
reading the file.

Also: pinned SQLitePCLRaw.bundle_e_sqlite3 to 3.0.3 (EF Core Sqlite's own
transitive default bundles a pre-3.50.2 SQLite with a known high-severity
memory-corruption advisory); found and fixed a real xUnit test race where
concurrent test-class hosts stomped a shared static connection-string field,
fixed by disabling cross-class test parallelization rather than adding DI the
stores don't otherwise need.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/src/BigRegister.Api/Data/DocumentStore.cs

@@ -1,8 +1,8 @@
 namespace BigRegister.Api.Data;
 
 /// <summary>
-/// Stored document: metadata + bytes. The demo holds bytes IN-MEMORY (reset on
-/// restart) purely so re-opened wizards can preview/download what was uploaded — a
+/// Stored document: metadata + bytes. The demo persists bytes in the SQLite file
+/// (WP-22) purely so a re-opened wizard can preview/download what was uploaded — a
 /// real backend persists them to blob storage keyed by DocumentId. Bytes are never
 /// serialized into a JSON response; only the dedicated content endpoint streams them.
 /// </summary>
@@ -13,33 +13,48 @@ public sealed record StoredDocument(
   public bool Linked { get; set; }
 }
 
-public sealed record AuditEntry(DateTimeOffset At, string Action, string DocumentId, string CategoryId, string Actor);
+/// <summary>Id is EF Core's auto-increment key — not part of the positional
+/// constructor, so every existing `new AuditEntry(at, action, ...)` call site
+/// keeps working unchanged; EF Core assigns it on insert.</summary>
+public sealed record AuditEntry(DateTimeOffset At, string Action, string DocumentId, string CategoryId, string Actor)
+{
+  public long Id { get; init; }
+}
 
 /// <summary>
-/// In-memory document store + audit log (no DB). ponytail: one global lock — fine
-/// for a single-process demo store; swap for per-key locks if it ever serves load.
-/// The audit log holds metadata only (never file content or other PII).
+/// EF Core/SQLite-backed document store + audit log (WP-22 — was a static
+/// Dictionary). ponytail: one global lock, same as before — SQLite tolerates only
+/// one writer at a time anyway, and this process already serialized all access
+/// through a single gate, so it now doubles as a coarse single-writer guard for
+/// the DB file. The audit log holds metadata only (never file content or other PII).
 /// </summary>
 public static class DocumentStore
 {
   /// The single seeded user (the demo has no real auth; ownership = this id).
   public const string DemoOwner = "19012345601";
 
-  private static readonly Dictionary<string, StoredDocument> _docs = new();
-  private static readonly List<AuditEntry> _audit = new();
   private static readonly object _gate = new();
 
   public static StoredDocument Add(string localId, string categoryId, string wizardId, string fileName, string contentType, byte[] content, string owner)
   {
     var doc = new StoredDocument(Guid.NewGuid().ToString(), localId, categoryId, wizardId, fileName, content.LongLength, contentType, content, owner, DateTimeOffset.UtcNow);
-    lock (_gate) _docs[doc.DocumentId] = doc;
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      db.Documents.Add(doc);
+      db.SaveChanges();
+    }
     Audit("upload", doc.DocumentId, categoryId, owner);
     return doc;
   }
 
   public static StoredDocument? Get(string documentId)
   {
-    lock (_gate) return _docs.TryGetValue(documentId, out var d) ? d : null;
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      return db.Documents.Find(documentId);
+    }
   }
 
   /// Status for the poll-on-return pattern: a known localId is "complete" (it
@@ -47,15 +62,26 @@ public static class DocumentStore
   public static IReadOnlyList<StoredDocument> ByLocalIds(IEnumerable<string> localIds)
   {
     var set = localIds.ToHashSet();
-    lock (_gate) return _docs.Values.Where(d => set.Contains(d.LocalId)).ToList();
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      return db.Documents.Where(d => set.Contains(d.LocalId)).ToList();
+    }
   }
 
   /// Mark digital documents as linked to a finalised submission (blocks user delete).
   public static void Link(IEnumerable<string> documentIds)
   {
     lock (_gate)
+    {
+      using var db = Db.Create();
       foreach (var id in documentIds)
-        if (_docs.TryGetValue(id, out var d)) d.Linked = true;
+      {
+        var d = db.Documents.Find(id);
+        if (d is not null) d.Linked = true;
+      }
+      db.SaveChanges();
+    }
   }
 
   public enum DeleteResult { Ok, NotFound, Linked }
@@ -66,10 +92,13 @@ public static class DocumentStore
     string categoryId;
     lock (_gate)
     {
-      if (!_docs.TryGetValue(documentId, out var d) || d.Owner != owner) return DeleteResult.NotFound;
+      using var db = Db.Create();
+      var d = db.Documents.Find(documentId);
+      if (d is null || d.Owner != owner) return DeleteResult.NotFound;
       if (d.Linked) return DeleteResult.Linked;
       categoryId = d.CategoryId;
-      _docs.Remove(documentId);
+      db.Documents.Remove(d);
+      db.SaveChanges();
     }
     Audit("delete-user", documentId, categoryId, owner);
     return DeleteResult.Ok;
@@ -82,9 +111,12 @@ public static class DocumentStore
     string categoryId;
     lock (_gate)
     {
-      if (!_docs.TryGetValue(documentId, out var d)) return false;
+      using var db = Db.Create();
+      var d = db.Documents.Find(documentId);
+      if (d is null) return false;
       categoryId = d.CategoryId;
-      _docs.Remove(documentId);
+      db.Documents.Remove(d);
+      db.SaveChanges();
     }
     Audit("delete-admin", documentId, categoryId, actor);
     return true;
@@ -92,11 +124,23 @@ public static class DocumentStore
 
   public static void Audit(string action, string documentId, string categoryId, string actor)
   {
-    lock (_gate) _audit.Add(new AuditEntry(DateTimeOffset.UtcNow, action, documentId, categoryId, actor));
+    lock (_gate)
+    {
+      using var db = Db.Create();
+      db.AuditEntries.Add(new AuditEntry(DateTimeOffset.UtcNow, action, documentId, categoryId, actor));
+      db.SaveChanges();
+    }
   }
 
   public static IReadOnlyList<AuditEntry> AuditLog
   {
-    get { lock (_gate) return _audit.ToList(); }
+    get
+    {
+      lock (_gate)
+      {
+        using var db = Db.Create();
+        return db.AuditEntries.ToList();
+      }
+    }
   }
 }