Cloud reserves and shows the Organization's Cluster Domain #1019

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

Cloud owns the Organization's Cluster Domain. The founding Server's enrollment reserves it with the Organization slug; Server Settings shows the granted name (or "Not reserved yet") with a Publish now button that reserves when missing; deleting the Organization releases it.

Acceptance criteria

• organization_cluster_domain table as specified (token encrypted under APP_ENCRYPTION_SECRET), plus the optional certificate columns.
• PLOYZ_HOSTED_DNS_URL config with a Ployz-hosted default; the row records the granting endpoint.
• Optional PLOYZ_HOSTED_DNS_MINT_KEY, sent as a bearer token on reserve only when set.
• Founder enrollment completion reserves the name; a Hosted DNS failure never fails enrollment.
• Server Settings shows the name (copyable) or "Not reserved yet"; Publish now reserves when the row is missing.
• Organization-scope teardown calls release once, ignores failure, and the row cascades away; other teardown scopes, pairing reset and machine removal leave the domain alone.
• Tests use a fake Hosted DNS HTTP server and the Effect Postgres harness.

Blocked by

None - can start immediately