Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Http/Controllers/Merchant/StorefrontController.php

@@ -129,6 +129,9 @@ class StorefrontController extends Controller
             'qrCode' => $storefront->fresh(),
             'previewDataUri' => $this->imageGenerator->previewDataUri($storefront),
             'catalog' => $this->catalogProducts(),
+            'customDomains' => \App\Models\CustomDomain::where('qr_code_id', $storefront->id)->get(),
+            'customDomainsEnabled' => app(\App\Services\CustomDomain\CustomDomainService::class)->enabled(),
+            'customDomainServerIp' => config('customdomain.server_ip'),
         ]);
     }