What back end features are pain in the ass to build?

Access Control and its variants -

source: building it right now for our app. supports sharing, organizations, and role hierachy (viewers, editors, admins).

Initial setup: deployment, DB, development environment

Subscription management.

Custom fields on a key entity that can be added without additional code or refactoring.

Oauth flow.

Keeping out spam signups

Dashboards