Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/customdomain.php

@@ -0,0 +1,27 @@
+<?php
+
+$appHost = parse_url((string) env('APP_URL', 'https://merchant.ladill.com'), PHP_URL_HOST) ?: 'merchant.ladill.com';
+
+return [
+    // Custom domains are opt-in; the feature only surfaces/provisions when a
+    // Domains SSL API key is configured.
+    'enabled' => filter_var(env('CUSTOM_DOMAINS_ENABLED', true), FILTER_VALIDATE_BOOLEAN),
+
+    // This app's own host(s) — requests on any other host are treated as a
+    // customer custom domain and resolved to the mapped storefront.
+    'app_host' => $appHost,
+
+    // Where customers point their A records (apex + www).
+    'server_ip' => env('LADILL_APP_SERVER_IP', '161.97.138.149'),
+
+    // Central SSL provisioning (Ladill Domains).
+    'ssl_api_url' => rtrim(env('DOMAINS_SSL_API_URL', 'https://domains.ladill.com/api'), '/'),
+    'ssl_api_key' => env('DOMAINS_API_KEY_MERCHANT', ''),
+
+    // certbot issues + installs an nginx server block that includes this snippet
+    // (root + fastcgi for the Merchant app) so the custom domain serves this app.
+    'nginx_include' => env('CUSTOM_DOMAINS_NGINX_INCLUDE', '/etc/nginx/snippets/ladill-merchant-app.conf'),
+
+    // Shared secret to verify the signed completion callback from Domains.
+    'callback_secret' => env('SSL_CALLBACK_SECRET', ''),
+];