feat: add verified custom API domains

[heathermhuang]

Summary

Add verified inbound custom API domains for user-owned and shared endpoints. Existing endpoint-display settings do not provide ownership verification, per-domain authorization or operator lifecycle controls.

• Store domain ownership, TXT verification details, status and access grants; provide user and admin management screens.
• Verify TXT ownership before activation and provide the configured gateway CNAME target. TLS and proxy provisioning remain the operator's responsibility.
• Keep API-key authentication authoritative and enforce domain access for registered custom hosts; record domain context in usage logs. Unknown hosts retain the existing gateway behavior.
• Support owner, selected-user and all-user grants, plus administrative disable/enable/delete controls.
• Preserve administrative disables during owner verification, including verification already in flight. Conditional database writes update verification fields without overwriting concurrent access changes.
• Prevent owners from deleting a disabled record to re-register its hostname; administrators can explicitly enable or release it.
• Preserve valid client request IDs and generated Ent/Wire integration included in this branch.

Verification

• Regression tests cover create → verify → admin disable → owner verify/delete, explicit admin re-enable, and a disable during both successful and unsuccessful DNS verification.
• Repository tests prove stale verification cannot overwrite a disable and cannot overwrite concurrent access changes.
• Existing ownership, grant isolation, host routing, usage-log and frontend tests remain in place.
• Full backend unit/integration suites and Go lint pass locally; generated Ent/Wire output was verified during the rebase.
• Full upstream CI: unit and integration suites, frontend checks, Go lint, security scans, shell checks and CLA.

Current reviewed head: 6cfaf2b5298ad7ff036610e4601e5a768124a934. TLS provisioning and production rollout are separate operational steps.

Fixes #3720

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[puppywang]

I have read the CLA Document and I hereby sign the CLA github-actions[bot] ***@***.***> 于2026年8月12日周三 21:16写道：

…

*github-actions[bot]* left a comment (Wei-Shaw/sub2api#3801) <#3801 (comment)> Thank you for your contribution! Before we can merge this PR, we need you all to sign our Contributor License Agreement (CLA) <https://github.com/Wei-Shaw/sub2api/blob/main/CLA.md>. *To sign*, please reply with the following comment: I have read the CLA Document and I hereby sign the CLA You only need to sign once — it will be valid for all your future contributions to this project. ------------------------------ I have read the CLA Document and I hereby sign the CLA ------------------------------ *6* out of *7* committers have signed the CLA. ✅ (lenzhang)[https://github.com/lenzhang] ✅ (wucm667)[https://github.com/wucm667] ✅ (Wei-Shaw)[https://github.com/Wei-Shaw] ✅ (fengshao1227)[https://github.com/fengshao1227] ✅ (IanShaw027)[https://github.com/IanShaw027] ✅ (Pluviobyte)[https://github.com/Pluviobyte] ❌ @puppywang <https://github.com/puppywang> You can retrigger this bot by commenting *recheck* in this Pull Request. Posted by the *CLA Assistant Lite bot*. — Reply to this email directly, view it on GitHub <#3801?email_source=notifications&email_token=AAVFRBX4MBVD4YGAF2GJMYD5JRU3TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWG4ZTENBYGY42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM#issuecomment-5267324869>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAVFRBTBV64GE6T3BKND2OL5JRU3TAVCNFSNUABGKJSXA33TNF2G64TZHMYTCMJYGYYDCNJRHA5US43TOVSTWNBYGI4DEOBSGYZDPILWAI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAVFRBXB23JBWA7XHE3HPZD5JRU3TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWG4ZTENBYGY42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJKTGN5XXIZLSL5UW64Y> and Android <https://github.com/notifications/mobile/android/AAVFRBX763KFPH4SDRP4R6T5JRU3TA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRWG4ZTENBYGY42M4TFMFZW63VHNVSW45DJN5XKKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI>. Download it today! You are receiving this because you were mentioned.Message ID: ***@***.***>

[heathermhuang]

Update: the administrative-disable finding is fixed in 6cfaf2b52, and the full upstream CI suite passes on that head.

Owner verification preserves administrative disables. Conditional database updates also prevent an in-flight verification from overwriting a later disable or concurrent access changes. Owners cannot delete a disabled record to re-register it; an administrator must explicitly enable or release it. Regression tests cover the original bypass, both DNS outcomes during a concurrent disable, database persistence and explicit re-enable.

@Wei-Shaw could you review the updated ownership and lifecycle implementation? Verified inbound domains still add useful white-label and tenant endpoint controls beyond endpoint-display settings. The earlier authorization blocker has been addressed, and the description now documents the proxy/TLS boundary and current verification.