feat(middleware): harden routing with fail-closed policy, custom subdomain management, and perf fixes

- Fix IPv6 host parsing with _strip_port() utility
- Remove dangerous StorePlatform→Store.subdomain silent fallback
- Close storefront gate bypass when frontend_type is None
- Add custom subdomain management UI and API for stores
- Add domain health diagnostic tool
- Convert db.add() in loops to db.add_all() (24 PERF-006 fixes)
- Add tests for all new functionality (18 subdomain service tests)
- Add .github templates for validator compliance

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/unit/middleware/test_ipv6_host_parsing.py

@@ -0,0 +1,63 @@
+# tests/unit/middleware/test_ipv6_host_parsing.py
+"""
+Unit tests for _strip_port() IPv6-safe host parsing utility.
+
+Ensures the middleware correctly strips ports from:
+- IPv4 hosts (localhost:8000)
+- IPv6 hosts ([::1]:8000)
+- Bare hostnames (example.com)
+- Edge cases (empty, malformed brackets)
+"""
+
+import pytest
+
+from middleware.platform_context import _strip_port
+
+
+@pytest.mark.unit
+@pytest.mark.middleware
+class TestStripPort:
+    """Test _strip_port() handles all host formats correctly."""
+
+    def test_ipv4_with_port(self):
+        assert _strip_port("127.0.0.1:8000") == "127.0.0.1"
+
+    def test_ipv4_without_port(self):
+        assert _strip_port("127.0.0.1") == "127.0.0.1"
+
+    def test_localhost_with_port(self):
+        assert _strip_port("localhost:9999") == "localhost"
+
+    def test_localhost_without_port(self):
+        assert _strip_port("localhost") == "localhost"
+
+    def test_domain_with_port(self):
+        assert _strip_port("example.com:443") == "example.com"
+
+    def test_domain_without_port(self):
+        assert _strip_port("example.com") == "example.com"
+
+    def test_ipv6_with_brackets_and_port(self):
+        assert _strip_port("[::1]:8000") == "::1"
+
+    def test_ipv6_with_brackets_no_port(self):
+        assert _strip_port("[::1]") == "::1"
+
+    def test_ipv6_full_address_with_port(self):
+        assert _strip_port("[2001:db8::1]:443") == "2001:db8::1"
+
+    def test_ipv6_full_address_no_port(self):
+        assert _strip_port("[2001:db8::1]") == "2001:db8::1"
+
+    def test_empty_string(self):
+        assert _strip_port("") == ""
+
+    def test_bare_hostname(self):
+        assert _strip_port("myhost") == "myhost"
+
+    def test_subdomain_with_port(self):
+        assert _strip_port("store.omsflow.lu:8080") == "store.omsflow.lu"
+
+    def test_malformed_brackets_no_closing(self):
+        """Malformed bracket with no closing ] returns as-is."""
+        assert _strip_port("[::1") == "[::1"