feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/unit/test_program_service.py

@@ -414,9 +414,10 @@ class TestGetProgramStats:
         db.flush()
 
         # Create cards with customers
+        customers = []
         for i in range(3):
             uid = uuid.uuid4().hex[:8]
-            customer = Customer(
+            customers.append(Customer(
                 email=f"stat_{uid}@test.com",
                 first_name="Stat",
                 last_name=f"Customer{i}",
@@ -424,11 +425,13 @@ class TestGetProgramStats:
                 customer_number=f"SC-{uid.upper()}",
                 store_id=store.id,
                 is_active=True,
-            )
-            db.add(customer)
-            db.flush()
+            ))
+        db.add_all(customers)
+        db.flush()
 
-            card = LoyaltyCard(
+        cards = []
+        for i, customer in enumerate(customers):
+            cards.append(LoyaltyCard(
                 merchant_id=ps_merchant.id,
                 program_id=ps_program.id,
                 customer_id=customer.id,
@@ -437,8 +440,8 @@ class TestGetProgramStats:
                 total_points_earned=100 * (i + 1),
                 is_active=True,
                 last_activity_at=datetime.now(UTC),
-            )
-            db.add(card)
+            ))
+        db.add_all(cards)
         db.commit()
 
         stats = self.service.get_program_stats(db, ps_program.id)
@@ -560,9 +563,10 @@ class TestGetMerchantStats:
         db.add(store)
         db.flush()
 
+        customers = []
         for i in range(2):
             uid = uuid.uuid4().hex[:8]
-            customer = Customer(
+            customers.append(Customer(
                 email=f"mstat_{uid}@test.com",
                 first_name="MS",
                 last_name=f"Customer{i}",
@@ -570,11 +574,13 @@ class TestGetMerchantStats:
                 customer_number=f"MS-{uid.upper()}",
                 store_id=store.id,
                 is_active=True,
-            )
-            db.add(customer)
-            db.flush()
+            ))
+        db.add_all(customers)
+        db.flush()
 
-            card = LoyaltyCard(
+        cards = []
+        for i, customer in enumerate(customers):
+            cards.append(LoyaltyCard(
                 merchant_id=ps_merchant.id,
                 program_id=ps_program.id,
                 customer_id=customer.id,
@@ -584,8 +590,8 @@ class TestGetMerchantStats:
                 total_points_earned=200,
                 is_active=True,
                 last_activity_at=datetime.now(UTC),
-            )
-            db.add(card)
+            ))
+        db.add_all(cards)
         db.commit()
 
         stats = self.service.get_merchant_stats(db, ps_merchant.id)