Provision PowerDNS zones immediately on domain link and add ensure-zone command.

Async-only zone jobs left Ladill NS returning REFUSED for new domains, which surfaces as Let's Encrypt SERVFAIL during SSL issuance.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Services/Domain/DomainVerificationService.php

@@ -3,6 +3,7 @@
 namespace App\Services\Domain;
 
 use App\Jobs\MailProvisioningJob;
+use App\Jobs\ProvisionDomainSlaveZoneJob;
 use App\Jobs\ProvisionDomainZoneJob;
 use App\Jobs\SslProvisioningJob;
 use App\Models\Domain;
@@ -12,6 +13,7 @@ use App\Models\DomainNsCheck;
 use App\Notifications\DomainVerifiedNotification;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 
 class DomainVerificationService
@@ -265,7 +267,26 @@ class DomainVerificationService
 
     public function reprovision(Domain $domain): void
     {
-        $this->dispatchProvisioningChain($domain->id);
+        $domain = $domain->fresh() ?? $domain;
+        $this->ensureDkimKeys($domain);
+
+        // Create the authoritative zone immediately when possible. Async-only
+        // provisioning left Ladill NS delegated with REFUSED answers (SERVFAIL
+        // for Let's Encrypt) whenever the queue lagged or failed.
+        try {
+            $this->pdns->ensureZone($domain->fresh());
+            ProvisionDomainSlaveZoneJob::dispatch($domain->id);
+        } catch (\Throwable $e) {
+            Log::warning('Immediate PDNS ensureZone failed; queueing retry', [
+                'domain_id' => $domain->id,
+                'host' => $domain->host,
+                'error' => $e->getMessage(),
+            ]);
+            ProvisionDomainZoneJob::dispatch($domain->id);
+        }
+
+        MailProvisioningJob::dispatch($domain->id);
+        SslProvisioningJob::dispatch($domain->id);
     }
 
     private function dispatchProvisioningChain(int $domainId): void