Vanity URL: production cutover at DUP retirement (#207 follow-up)

#### Description:

Split out of #207 so that ticket can close. All dev/test front-door and vanity-hostname work is complete and verified; everything remaining is production DNS work gated on **DUP retirement**, which is a PO call expected months out (as of 2026-08). Keeping it separate avoids mixing dev/test and prod concerns in one ticket.

Nothing here touches production until DUP is actually being retired.

#### Checklist:

- [ ] **Public — prod cutover.** Release the `reserve.bcparks.ca` alias from DUP dist `E1HZ22AUKHP3Z` → attach it to the prod front door → parks web flips the CNAME. Lower the TTL first; rollback is the reverse. No landing page at launch — the `/` → `/dayuse` 301 matches what prod already does today.
- [ ] **Admin — hostname takeover.** `reserve-admin.bcparks.ca` moves from DUP admin (`EJYK43B5R2525`) to the reserve-rec admin distribution: prod ACM cert covering the name, then `certificateArn` + `domainNames` in the prod `distributionStack` SSM config, then the CNAME flip. The CDK support already exists (bcgov/reserve-rec-admin#361) and is inert until those config keys are set — prod synthesizes unchanged today.

#### Notes:

- Cert provisioning in us-east-1 must go through the ACM API, not CloudFormation — LZA SCP blocks CFN in that region.
- The nonprod multi-SAN cert (`9ebe68e3-9047-41e2-8e9d-462aeaa0e0ba`) covers only the dev/test names; prod needs its own.
- Pattern to follow is what dev/test now run: distribution alias + cert, DNS CNAME, then `COGNITO_REDIRECT_URI` / `API_LOCATION` / Cognito callback URLs pointed at the vanity host.

Ref #207

Start with this issue's production cutover checklist, then read the dev/test pattern and the CDK support in bcgov/reserve-rec-admin#361. Confirm the production ACM certificate, distributionStack SSM keys, distribution aliases, DNS CNAMEs, and vanity-host callback settings only after DUP retirement. Done means both public and admin production hostnames have been cut over and rollback details remain available.

Written by the indexing model from the issue text.