backend-reviewlisted

# Backend Review Review backend changes for behavior, contract, data, security, and operational correctness. Start with the diff and follow only the affected execution paths. Prefer exact evidence over style preferences or assumptions, and do not call a change safe because it compiles or a happy-path test passes. ## Establish scope and execution path Identify entry points, handlers, workers, services, repositories, external calls, queues, database writes, caches, configuration, identities, and callers affected by the change. Read the public contract, validation rules, error model, transaction policy, retry behavior, migrations, and adjacent tests. State unknown consumers, unavailable environments, pre-existing changes, and out-of-scope systems. Never use real secrets or production data for review. ## Review the critical boundaries Check: - **Input and authorization:** validate type, size, encoding, requiredness, ranges, nested data, and ownership at the service boundary; authenticate and authorize every privileged or object-level operation; default to deny when identity or tenant context is absent; - **Contracts and errors:** preserve request/response and event schemas, status codes, error identity, retryability, pagination, idempotency, and backward compatibility; avoid leaking stack traces, secrets, internal topology, or sensitive records; - **Transactions and consistency:** keep atomic changes inside the correct boundary, order side effects deliberately, handle parti