backend phase 1: config, reference & platform signals

Lay the cross-cutting platform backbone every later phase reads from. Adds
the first marketplace EF migration baseline (new `ops` schema) and the
mechanisms b2..b15 reuse: typed runtime config, an append-only audit trail,
an analytics event log, the holiday/bank-closure calendar, in-app
notifications, and the internal support-alert worklist.

Schema & migration
- New `ops` schema + migration InitialMarketplaceBaseline with 6 tables:
  PlatformConfigs (IAuditable), AuditLogs (append-only), SystemEvents,
  IranianHolidays, Notifications, SupportAlerts — with indexes/uniques and
  FKs to usr.Users. Seeded 12 config keys + 7 sample holidays via HasData.

Domain / Application
- IAuditable marker + [AuditRedacted] attribute; entities + string-code
  constant holders (config data_type, holiday type, alert type/severity/status).
- Facade contracts: IPlatformConfig, IHolidayCalendar, IAnalyticsSink,
  IAuditLogger, INotificationService, ISupportAlertService; DTOs +
  PagedResult<T>; evolved the INotificationDispatcher.Notification record to
  carry Type + DataJson; Pagination helper.
- 14 CQRS commands/queries (+ validators) wiring the endpoints to the facades.

Infrastructure
- DB-backed facade implementations in Persistence/Services/; real in-app
  INotificationDispatcher (removes the b0 log stub); notification-retention
  hosted service (purge is_read=1 AND age>90d).
- Extended AuditFieldInterceptor to also append an old/new-diff audit_logs row
  for every IAuditable change in the same transaction (PII redacted).
- Registered all facades + hosted service in AddPersistenceServices; removed
  the dispatcher registration from AddCrossCuttingSeams.

API
- 5 controllers: admin PlatformConfig/Holidays/Audit/SupportAlerts
  ([Authorize(DynamicPermission)]) + current-user Notifications ([Authorize]),
  all tenant-scoped and paginated. 16 Swagger paths total.

Money-correctness & safety rules honoured
- Config read at compute time (cached, parsed by data_type), never hardcoded;
  every config change is audited in the same transaction; audit_logs is
  append-only (no update/delete path); support alerts are admin-only;
  notifications are tenant-scoped; analytics is fire-and-forget.

Tests & docs
- 18 new foundation tests over in-memory SQLite (config typing + audit,
  holidays, notifications + tenancy + retention, support alerts, analytics);
  build clean (0 new code warnings), 22 tests green; migration applied to the
  dev DB and swagger.v1.json refreshed.
- Updated server Project map + CONVENTIONS, product data-model doc 12 (seeded
  config defaults), config-reference contract, mock registry, backend handoff/
  STATUS/report.

Follow-ups: add FK constraints for SupportAlerts.BookingId (b9) and ReviewId
(b14) when those tables land.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

product/data-model/12-audit-config-and-reference.html

@@ -23,6 +23,22 @@
 <p><strong>Role:</strong> High-volume behavioral/analytics event log. <strong>Why kept but de-emphasized:</strong> product analytics, not compliance. It grows unbounded — at scale, pipe it to an analytics sink/warehouse rather than the transactional DB. Fields unchanged.</p>
 <h3 id="platform_configs-core"><code>platform_configs</code> [CORE] <a class="anchor" href="#platform_configs-core" aria-hidden="true">#</a></h3>
 <p><strong>Role:</strong> Key-value runtime business parameters — change without a deploy. <strong>Why typed values:</strong> <code>data_type</code> tells the app how to parse. <strong>New keys</strong> this revision: <code>dispute_window_hours</code> (default 72), <code>vat_rate</code> (0.10), <code>bnpl_merchant_of_record</code>, <code>bnpl_provider_commission_rate</code>, <code>bnpl_settlement_timing</code>, cancellation-tier defaults — alongside the existing <code>platform_fee_rate</code>, <code>booking_payment_deadline_minutes</code>, <code>nurse_response_deadline_hours</code>, <code>nurse_payout_interval_days</code>, <code>evv_location_tolerance_meters</code>, <code>min_rating_for_support_alert</code>. <strong>Relations:</strong> referenced everywhere; changes audited.</p>
+<p><strong>Seeded defaults (as built, backend-phase-1).</strong> The baseline migration seeds every key below. Values marked _provisional_ were chosen as safe defaults where the product docs did not pin a number — confirm before launch; each is config-driven so it changes without a deploy.</p>
+<div class="table-wrap"><table><thead><tr><th>Key</th><th><code>data_type</code></th><th>Seeded value</th><th>Source</th></tr></thead><tbody>
+<tr><td><code>platform_fee_rate</code></td><td>decimal</td><td><code>0.15</code></td><td>_provisional_</td></tr>
+<tr><td><code>vat_rate</code></td><td>decimal</td><td><code>0.10</code></td><td>doc (10%, commission line only)</td></tr>
+<tr><td><code>dispute_window_hours</code></td><td>int</td><td><code>72</code></td><td>doc</td></tr>
+<tr><td><code>booking_payment_deadline_minutes</code></td><td>int</td><td><code>30</code></td><td>doc</td></tr>
+<tr><td><code>nurse_response_deadline_hours</code></td><td>int</td><td><code>24</code></td><td>_provisional_</td></tr>
+<tr><td><code>nurse_payout_interval_days</code></td><td>int</td><td><code>7</code></td><td>doc (weekly)</td></tr>
+<tr><td><code>evv_location_tolerance_meters</code></td><td>int</td><td><code>200</code></td><td>_provisional_</td></tr>
+<tr><td><code>min_rating_for_support_alert</code></td><td>decimal</td><td><code>2</code></td><td>_provisional_ (review ≤ 2 raises an alert)</td></tr>
+<tr><td><code>bnpl_merchant_of_record</code></td><td>string</td><td><code>platform</code></td><td>doc (Balinyaar is MoR)</td></tr>
+<tr><td><code>bnpl_provider_commission_rate</code></td><td>decimal</td><td><code>0.07</code></td><td>_provisional_</td></tr>
+<tr><td><code>bnpl_settlement_timing</code></td><td>string</td><td><code>immediate</code></td><td>_provisional_</td></tr>
+<tr><td><code>cancellation_tiers</code></td><td>json</td><td><code>[{"min_hours_before":48,"refund_percent":100},{"min_hours_before":24,"refund_percent":50},{"min_hours_before":0,"refund_percent":0}]</code></td><td>_provisional_</td></tr>
+</tbody></table></div>
+<p>Rates are <code>DECIMAL</code> fractions (not money); the IRR amounts they later multiply are <code>BIGINT</code>. <strong>Read them at compute time (cached via <code>IPlatformConfig</code>), never hardcode</strong>, and snapshot the rate used onto the priced booking/invoice so a later rate change never re-prices an existing row.</p>
 <h3 id="iranian_holidays-mvp-new"><code>iranian_holidays</code> [MVP] — <strong>NEW</strong> <a class="anchor" href="#iranian_holidays-mvp-new" aria-hidden="true">#</a></h3>
 <p><strong>Role:</strong> Shared official/religious holiday calendar (movable, partly lunar-Hijri), with a <code>is_bank_closed</code> flag. <strong>Why a real table:</strong> Iran's holidays are numerous and partly movable, and they drive <strong>payout bank-closure scheduling</strong> (PAYA/SATNA closed → a weekly payout shifts to the next business day), optional holiday pricing, and business-hour deadline math — none of which a purely manual per-nurse availability exception can express.</p>
 <div class="table-wrap"><table><thead><tr><th>Field</th><th>Type</th><th>Notes</th></tr></thead><tbody>

product/data-model/12-audit-config-and-reference.md

@@ -11,6 +11,25 @@
 ### `platform_configs` [CORE]
 **Role:** Key-value runtime business parameters — change without a deploy. **Why typed values:** `data_type` tells the app how to parse. **New keys** this revision: `dispute_window_hours` (default 72), `vat_rate` (0.10), `bnpl_merchant_of_record`, `bnpl_provider_commission_rate`, `bnpl_settlement_timing`, cancellation-tier defaults — alongside the existing `platform_fee_rate`, `booking_payment_deadline_minutes`, `nurse_response_deadline_hours`, `nurse_payout_interval_days`, `evv_location_tolerance_meters`, `min_rating_for_support_alert`. **Relations:** referenced everywhere; changes audited.
 
+**Seeded defaults (as built, backend-phase-1).** The baseline migration seeds every key below. Values marked _provisional_ were chosen as safe defaults where the product docs did not pin a number — confirm before launch; each is config-driven so it changes without a deploy.
+
+| Key | `data_type` | Seeded value | Source |
+|---|---|---|---|
+| `platform_fee_rate` | decimal | `0.15` | _provisional_ |
+| `vat_rate` | decimal | `0.10` | doc (10%, commission line only) |
+| `dispute_window_hours` | int | `72` | doc |
+| `booking_payment_deadline_minutes` | int | `30` | doc |
+| `nurse_response_deadline_hours` | int | `24` | _provisional_ |
+| `nurse_payout_interval_days` | int | `7` | doc (weekly) |
+| `evv_location_tolerance_meters` | int | `200` | _provisional_ |
+| `min_rating_for_support_alert` | decimal | `2` | _provisional_ (review ≤ 2 raises an alert) |
+| `bnpl_merchant_of_record` | string | `platform` | doc (Balinyaar is MoR) |
+| `bnpl_provider_commission_rate` | decimal | `0.07` | _provisional_ |
+| `bnpl_settlement_timing` | string | `immediate` | _provisional_ |
+| `cancellation_tiers` | json | `[{"min_hours_before":48,"refund_percent":100},{"min_hours_before":24,"refund_percent":50},{"min_hours_before":0,"refund_percent":0}]` | _provisional_ |
+
+Rates are `DECIMAL` fractions (not money); the IRR amounts they later multiply are `BIGINT`. **Read them at compute time (cached via `IPlatformConfig`), never hardcode**, and snapshot the rate used onto the priced booking/invoice so a later rate change never re-prices an existing row.
+
 ### `iranian_holidays` [MVP] — **NEW**
 **Role:** Shared official/religious holiday calendar (movable, partly lunar-Hijri), with a `is_bank_closed` flag. **Why a real table:** Iran's holidays are numerous and partly movable, and they drive **payout bank-closure scheduling** (PAYA/SATNA closed → a weekly payout shifts to the next business day), optional holiday pricing, and business-hour deadline math — none of which a purely manual per-nurse availability exception can express.