feat(admin): affiliate/personal discounts, user-videos, internal routes, authz

Closes the remaining legacy-admin gaps:
- Users «مدیریت» modal: create personal discount or affiliate code (owner_user_id +
  owner_profit_percentage on existing /v1/discounts), and view the user's saved
  projects ("videos") via new admin GET /v1/saved-projects/by-user/{id} (studio)
- Internal routes admin (/admin/routes): CRUD on content.internal_routes
  (RoutesController + CmsService + gateway /v1/routes/*)
- Security: lock identity UsersController Search + Ban to [Authorize(Roles="Admin")]

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/content/FlatRender.ContentSvc/Application/Services/CmsService.cs

@@ -223,6 +223,41 @@ public class CmsService(ContentDbContext db)
         e.StartsAt = Utc(r.StartsAt); e.EndsAt = Utc(r.EndsAt);
     }
 
+    // ── Internal routes ─────────────────────────────────────────────────────────
+
+    public async Task<List<InternalRouteResponse>> GetRoutesAsync(Guid? tenantId)
+    {
+        return await db.InternalRoutes
+            .Where(x => x.TenantId == null || x.TenantId == tenantId)
+            .OrderBy(x => x.Priority)
+            .Select(r => new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate))
+            .ToListAsync();
+    }
+
+    public async Task<InternalRouteResponse> CreateRouteAsync(UpsertRouteRequest req)
+    {
+        var r = new InternalRoute { Name = req.Name, Image = req.Image, Slug = req.Slug, Priority = req.Priority, LastDate = Utc(req.LastDate) };
+        db.InternalRoutes.Add(r);
+        await db.SaveChangesAsync();
+        return new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate);
+    }
+
+    public async Task<InternalRouteResponse> UpdateRouteAsync(Guid id, UpsertRouteRequest req)
+    {
+        var r = await db.InternalRoutes.FindAsync(id) ?? throw new KeyNotFoundException($"Route {id} not found");
+        r.Name = req.Name; r.Image = req.Image; r.Slug = req.Slug; r.Priority = req.Priority;
+        r.LastDate = Utc(req.LastDate); r.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate);
+    }
+
+    public async Task DeleteRouteAsync(Guid id)
+    {
+        var r = await db.InternalRoutes.FindAsync(id) ?? throw new KeyNotFoundException($"Route {id} not found");
+        db.InternalRoutes.Remove(r);
+        await db.SaveChangesAsync();
+    }
+
     // ── Website Settings ──────────────────────────────────────────────────────
 
     public async Task<List<WebsiteSettingResponse>> GetSettingsAsync(Guid? tenantId, bool includeSecret = false)

services/content/FlatRender.ContentSvc/Controllers/CmsController.cs

@@ -181,3 +181,30 @@ public class FavoritesController(CmsService svc) : ControllerBase
         return NoContent();
     }
 }
+
+[ApiController]
+[Route("v1/routes")]
+public class RoutesController(CmsService svc) : ControllerBase
+{
+    [HttpGet]
+    public async Task<IActionResult> List([FromQuery] Guid? tenantId = null) =>
+        Ok(await svc.GetRoutesAsync(tenantId));
+
+    [Authorize(Roles = "Admin")]
+    [HttpPost]
+    public async Task<IActionResult> Create([FromBody] UpsertRouteRequest req) =>
+        Ok(await svc.CreateRouteAsync(req));
+
+    [Authorize(Roles = "Admin")]
+    [HttpPut("{id:guid}")]
+    public async Task<IActionResult> Update(Guid id, [FromBody] UpsertRouteRequest req) =>
+        Ok(await svc.UpdateRouteAsync(id, req));
+
+    [Authorize(Roles = "Admin")]
+    [HttpDelete("{id:guid}")]
+    public async Task<IActionResult> Delete(Guid id)
+    {
+        await svc.DeleteRouteAsync(id);
+        return NoContent();
+    }
+}

services/content/FlatRender.ContentSvc/Models/Requests/Requests.cs

@@ -95,6 +95,14 @@ public record CreateMusicTrackRequest(
     int Sort
 );
 
+public record UpsertRouteRequest(
+    string Slug,
+    string? Name = null,
+    string? Image = null,
+    int Priority = 5,
+    DateTime? LastDate = null
+);
+
 public record UpsertHomeEventRequest(
     string? Title,
     string? Subtitle,

services/content/FlatRender.ContentSvc/Models/Responses/Responses.cs

@@ -415,6 +415,15 @@ public record SlideResponse(
     bool IsActive
 );
 
+public record InternalRouteResponse(
+    Guid Id,
+    string? Name,
+    string? Image,
+    string Slug,
+    int Priority,
+    DateTime? LastDate
+);
+
 public record HomePageEventResponse(
     Guid Id,
     string? Title,