Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/api.php

@@ -2,8 +2,12 @@
 
 use App\Http\Controllers\Api\MeController;
 use App\Http\Controllers\Api\QrCodeController;
+use App\Http\Controllers\Api\SslCallbackController;
 use Illuminate\Support\Facades\Route;
 
+// Signed SSL completion callback from Ladill Domains (HMAC-verified, no session).
+Route::post('/ssl-callback', SslCallbackController::class)->name('api.ssl-callback');
+
 Route::middleware(['auth:sanctum', \App\Http\Middleware\SetActingAccount::class])->prefix('v1')->group(function () {
     Route::get('/me', MeController::class);
 

routes/web.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Merchant\OrdersController;
 use App\Http\Controllers\Merchant\OverviewController;
 use App\Http\Controllers\Merchant\PayoutsController;
 use App\Http\Controllers\Merchant\ProductController;
+use App\Http\Controllers\Merchant\CustomDomainController;
 use App\Http\Controllers\Merchant\StorefrontController;
 use App\Http\Controllers\NotificationController;
 use App\Http\Controllers\Public\BookingController;
@@ -17,9 +18,17 @@ use App\Http\Controllers\Qr\TeamController;
 use App\Http\Controllers\SearchController;
 use Illuminate\Support\Facades\Route;
 
-Route::get('/', fn () => auth()->check()
-    ? redirect()->route('merchant.dashboard')
-    : redirect()->route('sso.connect'))->name('merchant.root');
+Route::get('/', function (\Illuminate\Http\Request $request) {
+    // A customer's connected custom domain serves its mapped storefront here.
+    $storefront = app(\App\Services\CustomDomain\CustomDomainService::class)->resolveStorefront($request->getHost());
+    if ($storefront) {
+        return app(QrScanController::class)->resolve($request, $storefront->short_code);
+    }
+
+    return auth()->check()
+        ? redirect()->route('merchant.dashboard')
+        : redirect()->route('sso.connect');
+})->name('merchant.root');
 
 Route::get('/login', [SsoLoginController::class, 'connect'])->name('login');
 Route::get('/sso/connect', [SsoLoginController::class, 'connect'])->name('sso.connect');
@@ -64,6 +73,11 @@ Route::middleware(['auth', 'platform.session'])->group(function () {
     Route::get('/storefronts/{storefront}/preview.png', [StorefrontController::class, 'preview'])->name('merchant.storefronts.preview');
     Route::get('/storefronts/{storefront}/download/{format}', [StorefrontController::class, 'download'])->name('merchant.storefronts.download')->whereIn('format', ['png', 'svg', 'pdf']);
 
+    // Custom domains (opt-in): connect a customer's own domain to a storefront.
+    Route::post('/storefronts/{storefront}/custom-domain', [CustomDomainController::class, 'store'])->name('merchant.custom-domain.store');
+    Route::post('/custom-domains/{customDomain}/verify', [CustomDomainController::class, 'verify'])->name('merchant.custom-domain.verify');
+    Route::delete('/custom-domains/{customDomain}', [CustomDomainController::class, 'destroy'])->name('merchant.custom-domain.destroy');
+
     Route::get('/products', [ProductController::class, 'index'])->name('merchant.products.index');
     Route::get('/products/create', [ProductController::class, 'create'])->name('merchant.products.create');
     Route::post('/products', [ProductController::class, 'store'])->name('merchant.products.store');