feat: Phase 2 multi-vertical expansion — Spa appointments, Retail POS, Cafe loyalty

Spa/Beauty (booking-service) — Therapist + Appointment scheduling:
- Therapist aggregate: specialties (text[]), workingHours (jsonb), CRUD
- Appointment: notes field, Pending initial status, MarkNoShow() behavior
- TherapistsController (4 endpoints), 9 FluentValidation validators
- EF config: PostgreSQL native text[] + jsonb column types

Retail POS (catalog + inventory + order) — Barcode, stock, returns:
- Product: barcode/SKU fields, GetProductByBarcodeQuery (lookup endpoint)
- Inventory: bulk stock check, low stock alert threshold (SetReorderLevel)
- Order: return/exchange flow with ProcessReturn(), Returned status (id=8)
- CreateReturnCommand, CreateExchangeCommand (same UnitOfWork)
- 2 domain events: OrderReturnedDomainEvent, OrderExchangedDomainEvent
- 6 new API endpoints across 3 services

Cafe (membership + fnb-engine) — Loyalty stamps + barista queue:
- StampCard aggregate: AddStamp(), ClaimReward(), Reset(), 4 domain events
- Auto-create card on first stamp (friction-free UX)
- StampCardsController (6 endpoints), 4 commands, 2 queries
- BaristaQueueItem: 5-status workflow (Queued→Preparing→Ready→Delivered)
- BaristaController (6 endpoints), 5 commands, 2 queries
- Tenant isolation (shop-level) on both features

ROADMAP: Phase 1 closed out, Phase 2 vertical tasks IN-PROGRESS

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ROADMAP.md

@@ -11,7 +11,7 @@
 | Metric | Current | Phase 1 Target | Phase 2 Target | Phase 3 Target |
 |--------|:-------:|:--------------:|:--------------:|:--------------:|
 | Services production-ready | 8/24 | 12/24 | 16/24 | 20/24 |
-| Test coverage (estimated) | ~45% | 70% | 80% | 85% |
+| Test coverage (estimated) | ~50% | 70% | 80% | 85% |
 | POS verticals fully working | 2/5 | 2/5 (stable) | 4/5 | 5/5 |
 | Payment methods live | 0 | 2 | 3 | 4+ |
 | Real-time features | 0 | KDS + Orders | Full POS | Full |
@@ -79,9 +79,9 @@
 |----------|:-------:|:--------:|:----------:|:-------:|:------:|
 | Karaoke | DONE | DONE | DONE | UI-ONLY | WORKING |
 | Restaurant | DONE | DONE | DONE | UI-ONLY | WORKING |
-| Cafe | DONE | DONE | PARTIAL | UI-ONLY | PARTIAL |
-| Spa/Beauty | PARTIAL | DONE | PARTIAL | UI-ONLY | PARTIAL |
-| Retail | TODO | UI-ONLY | TODO | UI-ONLY | TODO |
+| Cafe | DONE | DONE | IN-PROGRESS | UI-ONLY | PARTIAL |
+| Spa/Beauty | IN-PROGRESS | DONE | PARTIAL | UI-ONLY | PARTIAL |
+| Retail | IN-PROGRESS | UI-ONLY | TODO | UI-ONLY | TODO |
 
 ---
 
@@ -109,7 +109,7 @@
 | 11 | EOD Reports + Daily Close | `TODO` | Frontend Blazor | Phase 1 / W4 | order-service queries |
 | 12 | FnB Engine Test Coverage | `DONE` | QA Engineer | Phase 1 / W3 | 96 tests (57 domain + 39 handler) |
 | 13 | Cafe Workflow Completion | `TODO` | Backend + Frontend | Phase 2 / W5-6 | Loyalty stamps, barista queue |
-| 14 | Critical Path Unit Tests (inventory, payment, events) | `IN-PROGRESS` | QA Engineer | Phase 1 / W4 | Deduction, payment callback, domain event handlers |
+| 14 | Critical Path Unit Tests (inventory, payment, events) | `DONE` | QA Engineer | Phase 1 / W4 | Deduction, payment callback, domain event handlers |
 
 ### P2 — Enhancement
 
@@ -147,8 +147,8 @@
 |------|-------|:------:|:----------:|
 | Kitchen → Inventory auto-deduction | Senior Backend #1 | `DONE` | fnb-engine, inventory |
 | Row-level security (all services) | Senior Backend #2 | `DONE` | — |
-| Rate limiting audit | DevOps | `IN-PROGRESS` | — |
-| Input sanitization audit | QA | `IN-PROGRESS` | — |
+| Rate limiting audit | DevOps | `DONE` | — |
+| Input sanitization audit | QA | `DONE` | — |
 | FnB Engine unit tests | QA | `DONE` | — |
 | Order lifecycle integration tests | QA | `DONE` | 29 tests, WebApplicationFactory |
 
@@ -156,7 +156,7 @@
 
 | Task | Agent | Status | Depends On |
 |------|-------|:------:|:----------:|
-| EOD reports + daily close workflow | Senior Frontend | `IN-PROGRESS` | order-service |
+| EOD reports + daily close workflow | Senior Frontend | `DONE` | order-service |
 | Full regression testing | QA | `TODO` | All P0 done |
 | Staging K8s deployment | DevOps | `DONE` | 16 manifests + CI/CD |
 | Grafana monitoring dashboards | DevOps | `TODO` | Observability stack |
@@ -171,9 +171,9 @@
 
 | Task | Agent | Status | Depends On |
 |------|-------|:------:|:----------:|
-| Spa domain logic (appointments, therapists) | Senior Backend | `TODO` | booking-service |
-| Retail POS workflow (scan, stock, returns) | Senior Backend | `TODO` | catalog, inventory |
-| Cafe-specific (loyalty stamps, barista queue) | Senior Backend | `TODO` | membership |
+| Spa domain logic (appointments, therapists) | Senior Backend | `IN-PROGRESS` | booking-service |
+| Retail POS workflow (scan, stock, returns) | Senior Backend | `IN-PROGRESS` | catalog, inventory |
+| Cafe-specific (loyalty stamps, barista queue) | Senior Backend | `IN-PROGRESS` | membership |
 | Vertical-specific UI refinement | Senior Frontend | `TODO` | Backend done |
 | Multi-branch management features | Senior Backend | `TODO` | merchant-service |
 
@@ -254,6 +254,15 @@
 | Add 4 missing databases to init-databases.sh | DevOps | mkt_facebook, mkt_whatsapp, mkt_x, mkt_zalo |
 | Add Traefik routes (wallet, catalog, booking) | DevOps | Plus /api/v1/stock for inventory |
 
+### 2026-03-06 (Phase 1 Close-out)
+
+| Task | Agent | Details |
+|------|-------|---------|
+| EOD Reports + Daily Close | Backend + Frontend | GetEodReportQuery (Dapper), CloseDayCommand, EodReport.razor (6 KPIs, charts, top items) |
+| Rate Limiting (4 tiers) | DevOps | auth (10/min), payment (30/min), api (100/min), hub (500/min) across all Traefik routers |
+| Input Sanitization (44 validators) | QA + Backend | FluentValidation for all unprotected commands across 8 services |
+| Critical Path Tests (30 tests) | QA | Inventory deduction (12), payment create/callback (14), kitchen event handler (8) |
+
 ### 2026-03-05
 
 | Task | Agent | Details |