backend phase 1: config, reference & platform signals

Lay the cross-cutting platform backbone every later phase reads from. Adds
the first marketplace EF migration baseline (new `ops` schema) and the
mechanisms b2..b15 reuse: typed runtime config, an append-only audit trail,
an analytics event log, the holiday/bank-closure calendar, in-app
notifications, and the internal support-alert worklist.

Schema & migration
- New `ops` schema + migration InitialMarketplaceBaseline with 6 tables:
  PlatformConfigs (IAuditable), AuditLogs (append-only), SystemEvents,
  IranianHolidays, Notifications, SupportAlerts — with indexes/uniques and
  FKs to usr.Users. Seeded 12 config keys + 7 sample holidays via HasData.

Domain / Application
- IAuditable marker + [AuditRedacted] attribute; entities + string-code
  constant holders (config data_type, holiday type, alert type/severity/status).
- Facade contracts: IPlatformConfig, IHolidayCalendar, IAnalyticsSink,
  IAuditLogger, INotificationService, ISupportAlertService; DTOs +
  PagedResult<T>; evolved the INotificationDispatcher.Notification record to
  carry Type + DataJson; Pagination helper.
- 14 CQRS commands/queries (+ validators) wiring the endpoints to the facades.

Infrastructure
- DB-backed facade implementations in Persistence/Services/; real in-app
  INotificationDispatcher (removes the b0 log stub); notification-retention
  hosted service (purge is_read=1 AND age>90d).
- Extended AuditFieldInterceptor to also append an old/new-diff audit_logs row
  for every IAuditable change in the same transaction (PII redacted).
- Registered all facades + hosted service in AddPersistenceServices; removed
  the dispatcher registration from AddCrossCuttingSeams.

API
- 5 controllers: admin PlatformConfig/Holidays/Audit/SupportAlerts
  ([Authorize(DynamicPermission)]) + current-user Notifications ([Authorize]),
  all tenant-scoped and paginated. 16 Swagger paths total.

Money-correctness & safety rules honoured
- Config read at compute time (cached, parsed by data_type), never hardcoded;
  every config change is audited in the same transaction; audit_logs is
  append-only (no update/delete path); support alerts are admin-only;
  notifications are tenant-scoped; analytics is fire-and-forget.

Tests & docs
- 18 new foundation tests over in-memory SQLite (config typing + audit,
  holidays, notifications + tenancy + retention, support alerts, analytics);
  build clean (0 new code warnings), 22 tests green; migration applied to the
  dev DB and swagger.v1.json refreshed.
- Updated server Project map + CONVENTIONS, product data-model doc 12 (seeded
  config defaults), config-reference contract, mock registry, backend handoff/
  STATUS/report.

Follow-ups: add FK constraints for SupportAlerts.BookingId (b9) and ReviewId
(b14) when those tables land.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/CONVENTIONS.md

@@ -276,6 +276,26 @@ Wire `ICurrentUser` (HTTP context accessor wrapped in an interface, registered S
 > (`Baya.Infrastructure.Persistence/Interceptors/`), a `SaveChangesInterceptor` that reads time from
 > `IDateTimeProvider` and the user from `ICurrentUser` — not in the `DbContext` itself.
 
+> **As built (backend-phase-1) — reusable patterns you should follow:**
+> - **Config is rows, read at compute time.** Money-critical constants (commission %, VAT, deadlines,
+>   EVV tolerance, cancellation tiers) live in `platform_configs`, read via `IPlatformConfig.GetConfig<T>`
+>   (cached, parsed by the row's `data_type`) — **never hardcode**. Changing a rate must never
+>   retroactively alter an already-computed amount: later phases snapshot the rate onto the
+>   booking/invoice at compute time; do not live-re-read a rate for an already-priced row.
+> - **Append-only audit trail.** `audit_logs` is immutable — there is **no** update/delete path in app
+>   code. Mark a compliance-sensitive entity with `IAuditable` (`Baya.Domain/Common`) and the
+>   `AuditFieldInterceptor` writes an old/new diff row per change in the same transaction; annotate any
+>   encrypted/PII property with `[AuditRedacted]` so it is redacted (never plaintext) in the diff.
+>   `platform_configs` is the first `IAuditable` entity.
+> - **DB-backed platform facades** (`IPlatformConfig`/`IHolidayCalendar`/`IAnalyticsSink`/`IAuditLogger`/
+>   `INotificationService`/`ISupportAlertService`) live in `Persistence/Services/` and are the contracts
+>   other domains reuse — don't re-query these tables directly. `IAnalyticsSink` is fire-and-forget
+>   (never fail the caller); `INotificationService`/notification endpoints are always tenant-scoped to
+>   `ICurrentUser`; `support_alerts` are admin-only and never appear on a user-facing route.
+> - **Retention/scheduling seam.** Background jobs run behind the hosted-service seam
+>   (`NotificationRetentionHostedService`); real Hangfire/Quartz is deferred. The notification retention
+>   predicate is exactly `is_read = 1 AND age > 90d` — unread is never auto-deleted.
+
 ### Money is IRR `BIGINT` — integer-only, no floats
 
 Every monetary value is **IRR Rials stored as `long` / `BIGINT`**. There is **no float/decimal path** on money — not in entities, DTOs, the API, or arithmetic. Toman is display-only and converts to/from Rials **only** inside a provider adapter at its boundary, never in domain or shared code. If a money value object is introduced later it must be integer-only. The three booking amounts always satisfy `gross = commission + payout`.