Ownership proofs for server registration

[funkiirabu]

Problem

Anyone can register any server URL on suimpp.dev — there's no verification that the registrant controls the server. This could lead to impersonation or squatting.

Solution

Implement ownership verification using x-discovery.ownershipProofs from the OpenAPI spec.

Options to explore

1. DNS TXT record — registrant adds a TXT record to their domain proving control
2. Well-known endpoint — server must respond at /.well-known/suimpp-verify with a challenge token
3. Signed challenge — server signs a nonce with the recipient wallet key (proves on-chain identity)

Acceptance criteria

• Registration requires at least one ownership proof
• Existing unverified servers can be claimed retroactively
• verified badge displayed on server detail + listing pages
• Document the proof mechanism in the Discovery spec (/discovery)

Context

Deferred from Phase 4 scope. Currently server.verified defaults to false — this field exists but is never set to true through any automated flow.