feat(infra/domains): 域名池 + CDN 前置 + 签名端点分发 (tsk_NU9JuUweHWMt)

- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息）
- cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook
- server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换
- tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换）
- tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回
- CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约
- 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/domains/cdn/terraform/settings.tf

@@ -0,0 +1,26 @@
+# Zone-wide security/TLS baseline (doc/05 §2 常规 Web 安全基线).
+resource "cloudflare_zone_settings_override" "this" {
+  zone_id = var.zone_id
+
+  settings {
+    ssl                      = "strict" # full (strict): verify origin cert
+    min_tls_version          = "1.2"
+    tls_1_3                  = "on"
+    always_use_https         = "on"
+    automatic_https_rewrites = "on"
+    opportunistic_encryption = "on"
+    brotli                   = "on"
+    security_level           = "high"
+    challenge_ttl            = 1800
+    browser_check            = "on"
+
+    # HSTS (doc/05 §2 全站 HSTS).
+    security_header {
+      enabled            = true
+      max_age            = 31536000
+      include_subdomains = true
+      preload            = true
+      nosniff            = true
+    }
+  }
+}