Add Compose-driven cross-service integration tests for the Order → Product → Notification flow

[devin-ai-integration]

Summary

Adds src/Tests/IntegrationTests — an xUnit suite that drives the running services over HTTP — plus a src/docker-compose.test.yml overlay that runs it as a container on the compose network after polling each dependency's /healthz:

docker compose -f src/docker-compose.yml -f src/docker-compose.test.yml run --rm integration-tests

Base URLs come from ORDER_URL / PRODUCT_URL / NOTIFICATION_URL (localhost defaults), so the same suite runs locally against an already-up stack.

The requested flow is only partially executable today. Order, Product and Customer are still scaffolds — GET-only stub controllers returning {"status":"scaffold"}, empty Domain/Entities, OnModelCreating TODOs, no POST endpoints, no product-existence validation, no OrderPlacedEvent publishing. So the suite is split:

• NotificationFlowTests — live and green: POST /api/notification/events/order-placed ingestion, persisted OrderId/CustomerId/OrderTotal, retrieval by id, HTML preview, unknown-id 404, invalid-guid 400, and the current (surprising) 201 for {} with default values.
• OrderProductNotificationFlowContractTests — the five requested steps written as complete, compiling tests, each [Fact(Skip = "…")] naming the exact missing capability. They are one implementation away from running. Assumed contracts (documented in the class doc and README): POST /api/product {name, description, price} → {id}, POST /api/order {customerId, items:[{productId, quantity}]} → {id, customerId, totalAmount}, order publishes the existing Shared.Contracts.Events.OrderPlacedEvent.
• ScaffoldGapTests — asserts the create endpoints are still 405 and the GETs still return the scaffold marker, so implementing the services makes these fail loudly; delete them at that point.

Two defects surfaced and are not fixed here:

1. NotificationRenderer.FormatCurrency treats the posted decimal as cents and formats with the process culture, so totalAmount: 42.50 renders as ¤0.43. The correct expectation is captured as a skipped test.
2. The gateway is bypassed on purpose: its YARP routes are plural (/api/orders) and its transforms strip the prefix into paths no controller matches, so every gateway route 404s.

Also required to make the stack buildable at all: every *.API.csproj referenced Shared as ..\..\Shared\… (one level short), which broke Notification.API's build and silently emitted MSB9008 for the rest.

-<ProjectReference Include="..\..\Shared\Shared.Contracts\Shared.Contracts.csproj" />
+<ProjectReference Include="..\..\..\Shared\Shared.Contracts\Shared.Contracts.csproj" />

Verified: all six entrypoints build clean; suite passes locally and via compose (10 passed, 6 skipped); dotnet format --verify-no-changes clean on the new project.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/b51ebf5228cc4f7ea6897107047dd477
Requested by: @sumitshatwara

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring