Switch from MAIL_MAILER=log to smtp pointing at mailpit on :1025. From-address mirrors LaravelEmailFactory's confirmation email format. phpunit.xml keeps MAIL_MAILER=array so unit and feature tests do not touch mailpit.
composer create-project laravel/laravel + artisan install:api. sanctum removed (custom session-cookie auth per ai/backend-context). personal_access_tokens migration + config/sanctum.php deleted. default .gitignore excludes vendor/, .env, etc - composer install recreates vendor at setup time.