feat(admin): affiliate/personal discounts, user-videos, internal routes, authz

Closes the remaining legacy-admin gaps:
- Users «مدیریت» modal: create personal discount or affiliate code (owner_user_id +
  owner_profit_percentage on existing /v1/discounts), and view the user's saved
  projects ("videos") via new admin GET /v1/saved-projects/by-user/{id} (studio)
- Internal routes admin (/admin/routes): CRUD on content.internal_routes
  (RoutesController + CmsService + gateway /v1/routes/*)
- Security: lock identity UsersController Search + Ban to [Authorize(Roles="Admin")]

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

services/content/FlatRender.ContentSvc/Application/Services/CmsService.cs

@@ -223,6 +223,41 @@ public class CmsService(ContentDbContext db)
         e.StartsAt = Utc(r.StartsAt); e.EndsAt = Utc(r.EndsAt);
     }
 
+    // ── Internal routes ─────────────────────────────────────────────────────────
+
+    public async Task<List<InternalRouteResponse>> GetRoutesAsync(Guid? tenantId)
+    {
+        return await db.InternalRoutes
+            .Where(x => x.TenantId == null || x.TenantId == tenantId)
+            .OrderBy(x => x.Priority)
+            .Select(r => new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate))
+            .ToListAsync();
+    }
+
+    public async Task<InternalRouteResponse> CreateRouteAsync(UpsertRouteRequest req)
+    {
+        var r = new InternalRoute { Name = req.Name, Image = req.Image, Slug = req.Slug, Priority = req.Priority, LastDate = Utc(req.LastDate) };
+        db.InternalRoutes.Add(r);
+        await db.SaveChangesAsync();
+        return new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate);
+    }
+
+    public async Task<InternalRouteResponse> UpdateRouteAsync(Guid id, UpsertRouteRequest req)
+    {
+        var r = await db.InternalRoutes.FindAsync(id) ?? throw new KeyNotFoundException($"Route {id} not found");
+        r.Name = req.Name; r.Image = req.Image; r.Slug = req.Slug; r.Priority = req.Priority;
+        r.LastDate = Utc(req.LastDate); r.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return new InternalRouteResponse(r.Id, r.Name, r.Image, r.Slug, r.Priority, r.LastDate);
+    }
+
+    public async Task DeleteRouteAsync(Guid id)
+    {
+        var r = await db.InternalRoutes.FindAsync(id) ?? throw new KeyNotFoundException($"Route {id} not found");
+        db.InternalRoutes.Remove(r);
+        await db.SaveChangesAsync();
+    }
+
     // ── Website Settings ──────────────────────────────────────────────────────
 
     public async Task<List<WebsiteSettingResponse>> GetSettingsAsync(Guid? tenantId, bool includeSecret = false)