ASP.NET Core Authentication System

I’m building a new ASP.NET Core Web API and I want the authentication and authorization layer to be rock-solid from day one. Here’s what I need built and wired up:

• User registration and login endpoints, following a clean service / repository pattern.
• Secure password hashing and salting.
• JWT access tokens with refresh-token support.
• Role-based authorization; the first role to support is “Admin”, though the structure should let me add “User”, “Guest” or any other role later without refactoring core logic.
• Email verification that triggers automatically after registration (I’m open to either a link or code flow—whatever integrates fastest with ASP.NET Core Identity).
• “Forgot / Reset password” flow that sends the user a reset link via email.
• Swagger/OpenAPI documentation generated from the controllers and models.
• SQL Server backend accessed through Entity Framework Core code-first migrations.
• Clean, well-commented code that passes typical security checks and follows SOLID principles.

Acceptance criteria:
1. Register-Login-Refresh cycle fully testable via Swagger.
2. Attempting to hit an [Authorize] endpoint without a valid JWT returns 401.
3. Password hashes stored using a proven algorithm (e.g., PBKDF2).
4. Admin-only endpoint demonstrably blocks non-Admin users.
5. Clear README with setup steps, EF migrations, and sample environment variables.

If you’ve built similar token-based auth modules with ASP.NET Core, Entity Framework Core, JWT, and SQL Server, let’s talk.