Custom .NET User Management

I’m building a new ASP.NET Core solution that consists of a Web API and a companion MVC / Razor Pages admin front-end. The sole focus of this milestone is the user-management layer.

Here’s what I need:

• A clean, well-structured user model with registration, secure login and password-recovery endpoints exposed through the API and surfaced in simple Razor Pages forms.
• Role-based access control baked in from the start, so I can assign roles and protect both controllers and individual actions with ease.
• A custom authentication mechanism (no OAuth or JWT this time) that still follows best practices—salted hashing, token-based email confirmations, lock-outs on repeated failures, etc.
• Clear, concise documentation so another developer can plug this module into future microservices without confusion, plus a short README that walks me through local setup and key extension points.
• Unit- and integration-test projects proving that registration, login, role checks and password reset flows behave exactly as intended.

Target framework is the latest stable .NET release; please keep the code idiomatic, leverage dependency injection and async/await throughout, and separate persistence from business logic so I can later switch out the data store without a rewrite. If you’ve built something similar before and can show a short demo or repo snippet, that’s a bonus.

Looking forward to working together—let’s make user management something I never have to worry about again.