Register issued certs with Ladill Domains central SSL registry

After provisioning a site cert on its node, report it to Domains' central SSL
registry (best-effort, non-blocking) so Domains tracks every platform cert.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Jobs/ProvisionHostingSslJob.php

@@ -70,6 +70,9 @@ class ProvisionHostingSslJob implements ShouldQueue
                 'site_id' => $this->siteId,
                 'domain' => $site->domain,
             ]);
+
+            // Record the cert in Ladill Domains' central SSL registry (best-effort).
+            app(\App\Services\Ssl\CentralSslRegistry::class)->register($site->domain, $site->ssl_expires_at);
         } catch (\Throwable $exception) {
             $message = $exception->getMessage();
 

app/Services/Ssl/CentralSslRegistry.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Services\Ssl;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Reports certificates this app issued (per hosting node) to Ladill Domains'
+ * central SSL registry, so Domains is the single source of truth for every
+ * platform certificate. Best-effort and non-blocking — issuance stays local.
+ */
+class CentralSslRegistry
+{
+    public function register(string $host, ?\DateTimeInterface $expiresAt = null): void
+    {
+        $url = rtrim((string) config('domains.api_url'), '/');
+        $key = (string) config('domains.api_key');
+        if ($url === '' || $key === '' || $host === '') {
+            return;
+        }
+
+        try {
+            Http::withToken($key)->acceptJson()->timeout(10)
+                ->post($url.'/ssl/register', array_filter([
+                    'host' => $host,
+                    'status' => 'active',
+                    'expires_at' => $expiresAt?->format(DATE_ATOM),
+                ]));
+        } catch (\Throwable $e) {
+            Log::info('CentralSslRegistry: register skipped', ['host' => $host, 'error' => $e->getMessage()]);
+        }
+    }
+}