feat(api): .NET 10 multi-tenant REST API

Full backend implementation:
- Multi-tenant cafe/restaurant management (menus, orders, tables, staff)
- POS order flow with ZarinPal and Snappfood payment integration
- OTP authentication via Kavenegar SMS
- QR digital menu with public discover/finder endpoints
- Customer loyalty, coupons, CRM
- PostgreSQL via EF Core, Redis for caching/sessions
- Background jobs, webhook handlers
- Full migration history

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

src/Meezi.API/Controllers/CafeApiControllerBase.cs

@@ -0,0 +1,38 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Meezi.Core.Enums;
+using Meezi.Core.Interfaces;
+using Meezi.Shared;
+
+namespace Meezi.API.Controllers;
+
+[Authorize]
+[ApiController]
+public abstract class CafeApiControllerBase : ControllerBase
+{
+    protected IActionResult? EnsureCafeAccess(string routeCafeId, ITenantContext tenant)
+    {
+        if (string.IsNullOrEmpty(tenant.CafeId) || tenant.CafeId != routeCafeId)
+            return StatusCode(StatusCodes.Status403Forbidden,
+                new ApiResponse<object>(false, null, new ApiError("FORBIDDEN", "You do not have access to this cafe.")));
+        return null;
+    }
+
+    protected IActionResult? EnsureOwner(ITenantContext tenant)
+    {
+        if (tenant.Role == EmployeeRole.Owner)
+            return null;
+        return StatusCode(StatusCodes.Status403Forbidden,
+            new ApiResponse<object>(false, null,
+                new ApiError("OWNER_REQUIRED", "Only the cafe owner can perform this action.")));
+    }
+
+    protected static ApiResponse<object> ValidationError(FluentValidation.Results.ValidationResult validation)
+    {
+        var first = validation.Errors.First();
+        return new ApiResponse<object>(false, null, new ApiError("VALIDATION_ERROR", first.ErrorMessage, first.PropertyName));
+    }
+
+    protected IActionResult NotFoundError(string message = "Resource not found.") =>
+        NotFound(new ApiResponse<object>(false, null, new ApiError("NOT_FOUND", message)));
+}