Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Merchant/CustomDomainController.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers\Merchant;
+
+use App\Http\Controllers\Controller;
+use App\Models\CustomDomain;
+use App\Models\QrCode;
+use App\Services\CustomDomain\CustomDomainService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class CustomDomainController extends Controller
+{
+    public function __construct(private readonly CustomDomainService $service) {}
+
+    public function store(Request $request, QrCode $storefront): RedirectResponse
+    {
+        abort_unless($storefront->user_id === $request->user()->id, 403);
+        abort_unless($this->service->enabled(), 404);
+
+        $data = $request->validate([
+            'host' => ['required', 'string', 'max:255', 'regex:/^(?!-)([a-z0-9-]+\.)+[a-z]{2,}$/i'],
+            'include_www' => ['nullable', 'boolean'],
+        ]);
+
+        $host = strtolower(preg_replace('/^www\./', '', trim($data['host'])));
+
+        if (CustomDomain::where('host', $host)->exists()) {
+            return back()->withErrors(['host' => 'That domain is already connected.']);
+        }
+
+        $this->service->attach($storefront, $host, (bool) ($data['include_www'] ?? true));
+
+        return back()->with('success', "Domain added. Point an A record for {$host} (and www) to ".config('customdomain.server_ip').', then click Verify.');
+    }
+
+    public function verify(Request $request, CustomDomain $customDomain): RedirectResponse
+    {
+        abort_unless($customDomain->user_id === $request->user()->id, 403);
+
+        [$ok, $message] = $this->service->verifyAndProvision($customDomain);
+
+        return back()->with($ok ? 'success' : 'error', $message);
+    }
+
+    public function destroy(Request $request, CustomDomain $customDomain): RedirectResponse
+    {
+        abort_unless($customDomain->user_id === $request->user()->id, 403);
+
+        $customDomain->delete();
+
+        return back()->with('success', 'Custom domain removed.');
+    }
+}

app/Http/Controllers/Merchant/StorefrontController.php

@@ -129,6 +129,9 @@ class StorefrontController extends Controller
             'qrCode' => $storefront->fresh(),
             'previewDataUri' => $this->imageGenerator->previewDataUri($storefront),
             'catalog' => $this->catalogProducts(),
+            'customDomains' => \App\Models\CustomDomain::where('qr_code_id', $storefront->id)->get(),
+            'customDomainsEnabled' => app(\App\Services\CustomDomain\CustomDomainService::class)->enabled(),
+            'customDomainServerIp' => config('customdomain.server_ip'),
         ]);
     }