feat(api): .NET 10 multi-tenant REST API

Full backend implementation:
- Multi-tenant cafe/restaurant management (menus, orders, tables, staff)
- POS order flow with ZarinPal and Snappfood payment integration
- OTP authentication via Kavenegar SMS
- QR digital menu with public discover/finder endpoints
- Customer loyalty, coupons, CRM
- PostgreSQL via EF Core, Redis for caching/sessions
- Background jobs, webhook handlers
- Full migration history

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tests/load/public-abuse.js

@@ -0,0 +1,40 @@
+import http from "k6/http";
+import { check, sleep } from "k6";
+
+const baseUrl = __ENV.BASE_URL || "http://localhost:5080";
+const qrCode = __ENV.QR_CODE || "demo_table_01";
+
+export const options = {
+  stages: [
+    { duration: "15s", target: 5 },
+    { duration: "30s", target: 20 },
+    { duration: "15s", target: 0 },
+  ],
+  thresholds: {
+    http_req_failed: ["rate<0.15"],
+    http_req_duration: ["p(95)<3000"],
+  },
+};
+
+export default function () {
+  const health = http.get(`${baseUrl}/health`);
+  check(health, { "health ok": (r) => r.status === 200 });
+
+  const discover = http.get(
+    `${baseUrl}/api/public/discover?city=${encodeURIComponent("تهران")}&requireProfile=false`
+  );
+  check(discover, {
+    "discover ok": (r) => r.status === 200,
+    "discover json": (r) => r.json("success") === true,
+  });
+
+  const qr = http.get(`${baseUrl}/api/q/${qrCode}`);
+  check(qr, {
+    "qr ok or not found": (r) => r.status === 200 || r.status === 404,
+  });
+
+  const security = http.get(`${baseUrl}/api/public/security-config`);
+  check(security, { "security-config ok": (r) => r.status === 200 });
+
+  sleep(0.3);
+}