Fix custom-domain test fixtures (public_id, bypass platform.session)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/Feature/CustomDomainTest.php

@@ -31,7 +31,7 @@ class CustomDomainTest extends TestCase
 
     private function storefront(?User $owner = null): QrCode
     {
-        $owner ??= User::factory()->create();
+        $owner ??= User::factory()->create(['public_id' => 'usr_'.uniqid()]);
 
         return QrCode::create([
             'user_id' => $owner->id,
@@ -115,8 +115,9 @@ class CustomDomainTest extends TestCase
     public function test_store_requires_storefront_ownership(): void
     {
         $store = $this->storefront();
-        $intruder = User::factory()->create();
+        $intruder = User::factory()->create(['public_id' => 'usr_'.uniqid()]);
 
+        $this->withoutMiddleware(\App\Http\Middleware\EnsurePlatformSession::class);
         $this->actingAs($intruder)
             ->post(route('merchant.custom-domain.store', $store), ['host' => 'brand.com'])
             ->assertForbidden();