Scope route updates to selected domain and network

[aslobodnik]

Summary

• scope admin subdomain updates to the selected domain
• align network-scoped auth checks across public API routes
• keep get-names public for anonymous reads while scoping optional API-key access to the selected network
• ensure set-domain updates only the authorized domain row

Verification

• npx eslint on touched auth and test files
• targeted Jest execution is blocked locally because the PostgreSQL test database is not reachable; CI is configured to run tests on the PR