feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/core/tests/integration/test_merchant_dashboard_routes.py

@@ -112,15 +112,14 @@ def dash_team_members(db, dash_stores, dash_owner):
     auth = AuthManager()
     users = []
     for _ in range(2):
-        u = User(
+        users.append(User(
             email=f"dteam_{uuid.uuid4().hex[:8]}@test.com",
             username=f"dteam_{uuid.uuid4().hex[:8]}",
             hashed_password=auth.hash_password("pass123"),
             role="store_user",
             is_active=True,
-        )
-        db.add(u)
-        users.append(u)
+        ))
+    db.add_all(users)
     db.flush()
 
     db.add(StoreUser(store_id=dash_stores[0].id, user_id=users[0].id, is_active=True))
@@ -132,19 +131,19 @@ def dash_team_members(db, dash_stores, dash_owner):
 @pytest.fixture
 def dash_customers(db, dash_stores):
     """Create customers in the merchant's stores."""
+    customers = []
     for i in range(4):
         uid = uuid.uuid4().hex[:8]
-        db.add(
-            Customer(
-                store_id=dash_stores[0].id,
-                email=f"dc_{uid}@test.com",
-                hashed_password="hashed",  # noqa: SEC001
-                first_name=f"F{i}",
-                last_name=f"L{i}",
-                customer_number=f"DC{uid}",
-                is_active=True,
-            )
-        )
+        customers.append(Customer(
+            store_id=dash_stores[0].id,
+            email=f"dc_{uid}@test.com",
+            hashed_password="hashed",  # noqa: SEC001
+            first_name=f"F{i}",
+            last_name=f"L{i}",
+            customer_number=f"DC{uid}",
+            is_active=True,
+        ))
+    db.add_all(customers)
     db.commit()