feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/unit/test_card_service.py

@@ -271,8 +271,8 @@ class TestGetStoreTransactions:
         from datetime import UTC, datetime
 
         # Create 3 transactions
-        for i in range(3):
-            t = LoyaltyTransaction(
+        txns = [
+            LoyaltyTransaction(
                 merchant_id=test_loyalty_card.merchant_id,
                 card_id=test_loyalty_card.id,
                 store_id=test_store.id,
@@ -280,7 +280,9 @@ class TestGetStoreTransactions:
                 points_delta=10 * (i + 1),
                 transaction_at=datetime.now(UTC),
             )
-            db.add(t)
+            for i in range(3)
+        ]
+        db.add_all(txns)
         db.commit()
 
         transactions, total = self.service.get_store_transactions(