Phase 4: The API

Build the backend for version one. Every endpoint your acceptance criteria require, and no others. Authorization filtered in the query rather than checked afterwards. One error shape, used everywhere. Then write the documentation you wished your sources had: base URL, auth, rate limit, paging, and what an error looks like, with a working curl command. Finally, attack it: sign in as one account and try to read and modify another's data by editing URLs. If anything succeeds, that is phase 4 not finished.