feat(domains): add UX path coverage for custom domain management API

[dennisonbertram]

Problem

The CHANGELOG mentions custom domains in v0.4.0, and Traefik supports TLS via Let's Encrypt, but no endpoint appears in the Feature Map for custom domain management and no UX path stories cover custom domain CRUD operations. If custom domain APIs exist, they need story coverage. If they do not exist yet, the feature needs to be designed and implemented.

Expected Behavior

• API endpoints for managing custom domains per service (e.g., POST /v1/services/{serviceID}/domains, DELETE /v1/services/{serviceID}/domains/{domain})
• DNS verification workflow (CNAME or TXT record validation)
• TLS certificate provisioning via Let's Encrypt for custom domains
• UX path stories covering the custom domain lifecycle

Context

Discovered via UX Paths analysis (docs/ux-paths/catalog.md — Gaps & Recommendations, item #5)

[dennisonbertram]

Needs clarification: Custom domain management is a large feature area. This issue should be scoped more specifically. Are we talking about: (1) CRUD endpoints for custom domains, (2) DNS verification flow, (3) TLS certificate provisioning, or (4) all of the above? See also issue #4 for related Litestream/infrastructure work. Consider breaking this into multiple smaller issues.

[dennisonbertram]

Needs clarification — this issue conflates two different things:

1. Feature: Build a per-service custom domain API (POST /v1/services/{id}/domains). This does NOT exist today — the --base-domain flag sets a platform-wide domain, and service URLs use {dns_label}.{base_domain}. There's no per-service custom domain override.

2. Documentation: Write UX path stories for custom domain management.

Questions:

1. Is this a feature request (build the API) or documentation request (write UX stories)?
2. Should custom domains be per-service or per-tenant?
3. Should they override the base domain or be additive (service accessible at both)?
4. How should DNS verification work (CNAME check, TXT record)?

Recommend splitting into two issues if feature work is desired. This is a large effort (schema changes, API handlers, Traefik dynamic config, DNS verification, TLS provisioning).