Subdomain & custom-domain storefronts (Netlify automation)

Why / Context

PRD §6.3: every creator gets a branded page "and optionally a custom domain" — the Educosys-style owned-brand experience without building their own stack. MVP shipped path-based storefronts (/c/[slug], locked decision); this issue adds wildcard subdomains then custom domains with automated provisioning on Netlify.

Schema already in place — NO migration required

• Tenant.subdomain (unique) and Tenant.customDomain (unique) + domainVerifiedAt
• Creator Pro entitlement customDomain: true (CREATOR_PRO plan seeded)
• Tenant branding fields (logo/banner/brandColors) already power storefronts

Implementation plan

1. Middleware tenant resolution: extend Next middleware to map Host header → tenant (subdomain {slug}.platform.com or customDomain) → rewrite to /(storefront)/[tenantSlug] routes; preserve path-based access.
2. Wildcard DNS: *.platform.com on Netlify (wildcard domain alias + wildcard TLS); reserved-subdomain blocklist (www, api, admin, studio, mail…).
3. Subdomain claim UX in studio settings (validation, uniqueness, instant activation).
4. Custom domains (Creator Pro gate): studio flow → learner adds CNAME/A records → verification poll (DNS lookup) → on verify, call Netlify API to add the domain alias to the site → set domainVerifiedAt.
5. Netlify automation service (src/lib/domains/netlify.ts): add/remove domain alias via Netlify API (PAT in env), status polling for TLS issuance, error surfacing in studio.
6. Auth/cookie scoping: BetterAuth cookies stay on the apex platform domain; storefront checkout hands off to platform-domain checkout (documented decision) — no cross-domain session leakage.
7. SEO: canonical URL strategy (custom domain becomes canonical when verified; path-based 301s), per-tenant sitemap on their domain.
8. Removal/offboarding: releasing a domain deletes the Netlify alias and clears fields; suspended tenants' domains park to a notice page.

Acceptance criteria

• demo-academy.platform.com serves the storefront with TLS, no code deploy per tenant
• Creator Pro tenant connects a custom domain end-to-end (DNS instructions → verified → TLS live)
• Non-Pro tenants see the upsell, cannot connect custom domains
• Checkout from a custom-domain storefront completes on the platform domain with session intact
• Canonicals/301s correct across the three URL forms

Dependencies / sequencing

• MVP M3 (storefronts) required; Netlify PAT + wildcard DNS are ops prerequisites

Start by tracing the existing Next middleware tenant resolution and storefront routes, then read src/lib/domains/netlify.ts and the existing Tenant and entitlement definitions. Map the Netlify, DNS verification, cookie, SEO, and offboarding flows before implementation; done means the listed acceptance criteria work for subdomains, Creator Pro custom domains, checkout handoff, and canonical URLs.