feat: add verified custom API domains

Dockerfile

@@ -147,7 +147,7 @@ RUN mkdir -p /app/data && chown sub2api:sub2api /app/data
 
 # Copy entrypoint script (fixes volume permissions then drops to sub2api)
 COPY deploy/docker-entrypoint.sh /app/docker-entrypoint.sh
-RUN chmod +x /app/docker-entrypoint.sh
+RUN chmod 0755 /app/docker-entrypoint.sh
 
 # Expose port (can be overridden by SERVER_PORT env var)
 EXPOSE 8080

backend/.golangci.yml

@@ -132,6 +132,10 @@ linters:
       - path: 'internal/service/openai_codex_models_service(_test)?\.go$'
         linters: [ staticcheck ]
         text: 'SA1019: golang\.org/x/net/http2\.GoAwayError\b'
+      - path: _test\.go
+        linters:
+          - staticcheck
+        text: "SA5011"
       # G703/G704 污点分析在测试文件中只会命中 httptest mock 与测试者自设的
       # 环境变量路径，不构成攻击面；且该分析跨环境结果不稳定（本地/CI 报告的
       # 位置集合不同），逐点 nolint 无法收敛，故按路径豁免。生产代码不豁免，