Nice walkthrough. One thing worth adding when applying STRIDE to a data flow: the trust boundary does most of the work. Threats cluster where data crosses a boundary you don't control (client to server, service to third party), so enumerating boundaries first and then running STRIDE per crossing keeps the exercise bounded instead of combinatorial. Also, repudiation is the letter teams most often wave away - concretely it's just 'do you have logs that would survive a dispute', and it usually folds into tampering controls like append-only audit logs. Treating it as a logging requirement rather than an abstract threat makes the output actionable.