Custom Domains: Fail-Closed DNS Verification

Bring-your-own client-portal domains now attach through a DNS ownership challenge — nothing serves on a domain until verification passes, and TLS is issued and renewed automatically.