Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/Services/CustomDomain/DnsResolver.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Services\CustomDomain;
+
+class DnsResolver
+{
+    /** @return array<int,string> the A-record IPs for a host */
+    public function aRecords(string $host): array
+    {
+        $records = @dns_get_record($host, DNS_A);
+        if (! is_array($records)) {
+            return [];
+        }
+
+        return array_values(array_filter(array_map(fn ($r) => $r['ip'] ?? null, $records)));
+    }
+}