Domains: CORS and TLS from the tenant domain map, not host config

Tenant domains are data, but CORS and TLS are host configuration. `Tenant.Domains` (`barakoCMS/Models/Tenant.cs:46`) and `barakoCMS/Features/Tenants/ByHostEndpoint.cs:54` resolve a host to a tenant at runtime. CORS reads `CORS:AllowedOrigins` (`barakoCMS/Extensions/ServiceCollectionExtensions.cs:346-354`), `AllowedHosts` is `*` in `barakoCMS/appsettings.json:18`, the API `Caddyfile` serves one `{$DOMAIN_API}`, and barakoPress's Caddyfile one `SITE_DOMAIN`.

### Why it matters

Adding a client's own domain (a bakery moving from a subdomain to bakery.ph) is a data change in the API and then a config edit and restart for CORS and a Caddyfile edit for TLS. Every client domain touches every other client's uptime, and a forgotten step shows up as a browser CORS error or a certificate warning.

### The general concept

CORS allows an origin when the tenant domain map resolves it, on top of any static origins in config. TLS uses Caddy's on-demand certificates with an `ask` endpoint backed by the same by-host lookup, so a domain added to a tenant gets a certificate on first request with no restart.

### Where it lives

Core: CORS policy and a small ask endpoint. Deploy: the Caddyfiles here and in BaryoVM (#88, #92). Relates #868.

### Compatibility

Released. `CORS:AllowedOrigins` keeps working and is combined with the map, so no existing origin is dropped. On-demand TLS is opt-in in the Caddyfile, and the single-domain file stays the default. No stored data changes.

### Done when

- A browser request from a domain added to a tenant passes CORS without a restart, and a test showing that fails today.
- The ask endpoint answers yes for a mapped domain and no for an unknown one.
- A deploy doc shows adding a client domain with no config edit.

Found in the architecture sweep of 15 September 2026.

Start with Tenant.cs and ByHostEndpoint.cs to trace host resolution, then inspect the CORS policy in ServiceCollectionExtensions.cs and the current appsettings.json setting. Review the API and barakoPress Caddyfiles, plus the related BaryoVM deployment references, and add the issue's requested CORS test, ask-endpoint behavior, and deployment documentation without removing static origins.

Written by the indexing model from the issue text.