Serve generated hostnames from the Organization's wildcard certificate #1023

Parent

Spec: Hosted DNS, Cluster Domain and wildcard certificates

What to build

Every generated hostname is served with a valid certificate from the Organization's wildcard. The sync generates a key and CSR when the wildcard is missing or has under 30 days left, obtains the chain from Hosted DNS, stores the key encrypted, and publishes *.name to the Cluster. Server Settings shows the wildcard's expiry.

Acceptance criteria

• Ensure-certificate step in sync-cluster-domain: new key + CSR for name and *.name when missing or within 30 days of certificate_not_after.
• The key is stored encrypted under APP_ENCRYPTION_SECRET, with the chain and certificate_not_after.
• Material is published through PublishCertificateMaterial, and republished when the Cluster lacks the current material (for example after re-pairing).
• Hosted DNS failure leaves the current certificate in place and retries on the next sync.
• Server Settings shows the wildcard's expiry.
• Tested with InngestTestEngine and a fake Hosted DNS certificate endpoint.

Blocked by

• Sync the Cluster Domain's apex records and lease from Cloud #1020
• Hosted DNS signs one wildcard certificate per Cluster Domain from a CSR #1017
• Publish Certificate Material for a hostname or wildcard #1022