feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/prospecting/services/prospect_service.py

@@ -127,15 +127,17 @@ class ProspectService:
 
         # Create inline contacts if provided
         contacts = data.get("contacts", [])
+        contact_objects = []
         for c in contacts:
-            contact = ProspectContact(
+            contact_objects.append(ProspectContact(
                 prospect_id=prospect.id,
                 contact_type=c["contact_type"],
                 value=c["value"],
                 label=c.get("label"),
                 is_primary=c.get("is_primary", False),
-            )
-            db.add(contact)
+            ))
+        if contact_objects:
+            db.add_all(contact_objects)
 
         db.flush()
         logger.info("Created prospect: %s (channel=%s)", prospect.display_name, channel)
@@ -144,6 +146,7 @@ class ProspectService:
     def create_bulk(self, db: Session, domain_names: list[str], source: str = "csv_import") -> tuple[int, int]:
         created = 0
         skipped = 0
+        new_prospects = []
         for name in domain_names:
             name = name.strip().lower()
             if not name:
@@ -152,14 +155,15 @@ class ProspectService:
             if existing:
                 skipped += 1
                 continue
-            prospect = Prospect(
+            new_prospects.append(Prospect(
                 channel=ProspectChannel.DIGITAL,
                 domain_name=name,
                 source=source,
-            )
-            db.add(prospect)
+            ))
             created += 1
 
+        if new_prospects:
+            db.add_all(new_prospects)
         db.flush()
         logger.info("Bulk import: %d created, %d skipped", created, skipped)
         return created, skipped