Post-MVP polish: custom-domain CLI (#114 follow-ups)

[samo-agent]

Post-MVP polish for the custom-domain CLI (#114). All non-blocking — samorev returned PASS on #114 — tracked for a follow-up pass.

1. Orphaned CF hostname on SSH failure (runDomainAdd): if the app-VM SSH step throws after CF create, the custom hostname exists on Cloudflare but no state record is written → domain rm can't find it. Fix: persist the DomainRecord immediately after a successful CF create (before the SSH step), or add domain repair <fqdn> (CF lookup by FQDN to recover the id).
2. CF 409 → human-readable message (runDomainAdd): a duplicate domain add surfaces the raw CF error; detect CloudflareError.status === 409 and emit "domain already registered on Cloudflare — run domain check <fqdn> to inspect status."
3. domain rm error message is aspirational: says "requires --yes (or interactive confirmation)" but defaultConfirm is never wired. Drop the "(or interactive confirmation)" clause, or wire it from destroy.ts.
4. vmIp format assertion in buildControlPlaneCustomDomainVhostScript — add a trivial IP-format check parallel to the existing isValidMainHost guards (defence-in-depth; not injectable in practice, source is the Hetzner API).
5. domain search exit code: always exits 0; consider exit 1 on "taken" for shell-idiomatic availability checks (--json already makes it scriptable).

[samo-agent]

Additional finding (live proof.samo.cat E2E) — should-fix, not a nit:

domain add defaults to DCV method: http, but the control-plane Caddy serves HTTPS-only, so http-DCV stalls — the cert never issues. The E2E had to PATCH the custom hostname to method: txt (whose dcv_delegation_records CNAME then validated) to get the cert.

Impact: a real customer using the default domain add (no --dcv txt) would see the cert hang indefinitely. Fix: default domain add to txt DCV (or auto-select txt when the origin path is HTTPS-only). This breaks the default happy path, so it's higher priority than the other items here.

[samo-agent]

UX gap (low severity, from the validation-path assessment): domain add doesn't validate/warn if the customer's routing CNAME is left proxied (orange-cloud) in Cloudflare — CF refuses a Custom Hostname whose CNAME is proxied, so it must be grey-cloud/unproxied. buildDnsInstructions states this in text, but domain add doesn't detect or warn when it's wrong. Worth a pre-flight check or a clearer warning so customers don't silently get a stuck hostname.

[samo-agent]

Fixed in commits 7d9c5a2 (RED) + 8d309d2 (GREEN) on feat/custom-domain-cli (PR #114).

Root cause confirmed: domain add defaulted to method: http. Control plane is HTTPS-only → http-DCV permanently stalls on port 80.

Fix: default flipped to txt in both the CLI parser (parseDomainAdd) and CloudflareDns.createCustomHostname. dcv_delegation_records added to the CustomHostname.ssl type; buildDnsInstructions now surfaces the _acme-challenge.<fqdn> → <hash>.dcv.cloudflare.com CNAME line in the output.

Re-verified on fresh throwaway dcvtest-8nn3ka.samo.cat:

• domain add field-record dcvtest-8nn3ka.samo.cat (no --dcv flag)
• Set 3 DNS records (routing CNAME + ownership TXT + DCV delegation CNAME)
• CF confirmed ssl_method: "txt" — no manual PATCH needed
• SSL active in ~2.5 min; curl https://dcvtest-8nn3ka.samo.cat/api/version → HTTP 200
• domain rm + DNS delete → zero artifacts, proof.samo.cat untouched

See full evidence: #114 (comment)

[samo-agent]

Reopening — the DCV-default item (comment above) is done and verified, but this issue tracks 6 other items that are NOT yet addressed:

• Orphaned CF hostname on SSH failure (persist state after CF create, or domain repair)
• CF 409 → human-readable message
• domain rm error message truthfulness ("or interactive confirmation" not wired)
• vmIp format assertion (defence-in-depth)
• domain search exit code (exit 1 on taken)
• Grey-cloud/unproxied CNAME warning at domain add time
• DCV default → txt + surface _acme-challenge delegation CNAME ✅ done

Also worth folding in: the delegation CNAME isn't in domain add's immediate output (CF populates dcv_delegation_records async) — surfaced via domain check instead. Acceptable, but note it in operator docs.