Add opt-in custom domains with automatic SSL

Customers can connect their own domain to a merchant page (storefront/event):
add a domain, point an A record (apex + www) to the app server, click Verify —
DNS is checked, then Ladill Domains' central SSL service issues + installs the
Let's Encrypt cert and calls back to flip it live. The custom domain then serves
the mapped page (host resolution on /). Feature-gated: only active when a Domains
SSL API key is set, so this deploy is inert until wired.

- custom_domains table + CustomDomain model
- CustomDomainService (DNS verify, request cert), DomainsSslClient, DnsResolver
- settings UI panel, signed SSL callback receiver, host resolution on /
- feature tests (DNS verify/fail, signed callback, ownership)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/api.php

@@ -2,8 +2,12 @@
 
 use App\Http\Controllers\Api\MeController;
 use App\Http\Controllers\Api\QrCodeController;
+use App\Http\Controllers\Api\SslCallbackController;
 use Illuminate\Support\Facades\Route;
 
+// Signed SSL completion callback from Ladill Domains (HMAC-verified, no session).
+Route::post('/ssl-callback', SslCallbackController::class)->name('api.ssl-callback');
+
 Route::middleware(['auth:sanctum', \App\Http\Middleware\SetActingAccount::class])->prefix('v1')->group(function () {
     Route::get('/me', MeController::class);