feat(domains): Simplify regions and automate domain HTTPS

[yuanzui-cf]

Summary

Regional CNAME targets no longer require DNS-provider credentials or their own certificates. Administrators configure entry DNS manually; verified customer domains receive their own HTTPS certificates.

• Add a shared region catalog with existing-region selection and New Region in platform settings and Node configuration. Preserve tags such as hk_1 and hk_frick; allow one entry per existing region.
• Check custom-domain DNS and ownership immediately, then every 60–120 seconds with persistent scheduling and leases. Keep review, disabled-binding, and entry-readiness gates before automatic issuance.
• Select Let's Encrypt or ZeroSSL centrally, use the adding user's email, encrypt ZeroSSL EAB credentials, and enable renewal by default. Show DNS errors, certificate retries, and actual installation readiness; retain valid certificates during failed renewals.
• Keep regions without entries available for Nodes/deployments, while explaining and rejecting unavailable custom-domain ingress choices.
• Apply breaking migrations 33–34 to backfill regions and onboarding contacts, remove entry certificate/provider state, and restrict managed certificates to customer bindings and HTTP-01. Existing documentation is unchanged as requested.

Validation

• just quality passed: formatting, Clippy with warnings denied, workspace tests/check/build, Console checks/tests/build, and license checks. Control API: 488 tests passed; Console: 235 tests passed.
• PostgreSQL disposable-schema integration tests passed for region backfill/references/uniqueness and domain onboarding. Inspected columns, defaults, nullability, foreign keys, indexes, constraints, and migration tracking; exercised up/down/up, DNS mismatch/ownership checks, 60–120 second scheduling, lease recovery, adding-user contacts, certificate idempotency, and encrypted CA settings.
• Mock ACME issuance, multi-node challenge acknowledgement, certificate withdrawal, and renewal-failure regression tests passed. Console tests cover region creation/selection, Node configuration saving, manual entry forms, unavailable regions, CA settings, and installation/renewal states.
• git diff --check passed.

Tracking

Closes #189.
Parent capability: #179. Related work: #181.

Known Limitations

• Public CA issuance was tested against a mock CA, not a live Let's Encrypt or ZeroSSL account. Operators must route public HTTP port 80 and HTTPS port 443 to TLS-enabled regional entry nodes; Cloudflare entry records should use DNS-only mode.
• Legacy custom bindings without a known project creator must be re-added to capture their contact account. Rollback restores the old schema, not removed entry credentials/certificates.
• An additional vp exec tsc --noEmit check remains blocked by existing repository type issues, including missing React/Node type declarations. The repository's required Console checks, tests, and production build pass.