feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/seed/seed_demo.py

@@ -955,6 +955,7 @@ def create_demo_stores(
             platform_rows = db.execute(select(Platform.id, Platform.code)).all()
             platform_code_map = {code: pid for pid, code in platform_rows}
 
+        store_platforms = []
         for i, (platform_id,) in enumerate(merchant_subs):
             # Per-platform subdomain override for multi-platform stores
             # Config uses platform codes; resolve to IDs
@@ -963,13 +964,14 @@ def create_demo_stores(
                 if platform_code_map.get(pcode) == platform_id:
                     custom_sub = subdomain_val
                     break
-            sp = StorePlatform(
+            store_platforms.append(StorePlatform(
                 store_id=store.id,
                 platform_id=platform_id,
                 is_active=True,
                 custom_subdomain=custom_sub,
-            )
-            db.add(sp)
+            ))
+        if store_platforms:
+            db.add_all(store_platforms)
 
         if merchant_subs:
             db.flush()