feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/tenancy/tests/unit/test_tenancy_metrics.py

@@ -68,15 +68,14 @@ def metrics_team_members(db, metrics_stores):
     auth = AuthManager()
     users = []
     for i in range(3):
-        u = User(
+        users.append(User(
             email=f"team_{uuid.uuid4().hex[:8]}@test.com",
             username=f"team_{uuid.uuid4().hex[:8]}",
             hashed_password=auth.hash_password("pass123"),
             role="store_user",
             is_active=True,
-        )
-        db.add(u)
-        users.append(u)
+        ))
+    db.add_all(users)
     db.flush()
 
     # User 0 on store 0 and store 1 (should be counted once)