feat(infra/domains): 域名池 + CDN 前置 + 签名端点分发 (tsk_NU9JuUweHWMt)

- domains.md: 四组域名隔离登记 + 冷备池 ≥5 + 启用流程（不含身份信息）
- cdn/terraform: Cloudflare 配置即代码（WAF/bot/速率限制/代理DNS/回源鉴权注入）+ 30min 重放 Runbook
- server/internal/originauth: 回源鉴权中间件，非 CDN 网段或鉴权头不符一律 403，支持双值轮换
- tools/endpoint-signer: 离线 Ed25519 签名 CLI（端点 + 公告文档，单调版本防回滚，key_id 双公钥轮换）
- tools/publish-mirrors: ≥3 镜像发布 + hash 一致性校验 + 故障转移取回
- CLIENT-CONTRACT.md: schema/验签/防回滚/合并/兜底链/channel 客户端契约
- 出站独立出口要求写入部署文档；私钥/token/身份信息一律不入库

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/domains/examples/endpoints.payload.example.json

@@ -0,0 +1,25 @@
+{
+  "api_domains": [
+    "api-a.example-alpha.com",
+    "api-b.example-bravo.net",
+    "api-c.example-charlie.org"
+  ],
+  "mirror_urls": [
+    "https://pages.example-pages.dev/endpoints.v1.json",
+    "https://raw.githubusercontent.com/example-alt-account/dist/main/endpoints.v1.json",
+    "https://obj.example-storage.com/dist/endpoints.v1.json"
+  ],
+  "emergency_nodes_hint": [
+    "builtin"
+  ],
+  "channel": "",
+  "notice": {
+    "id": "2026-q2-welcome",
+    "level": "info",
+    "title_zh": "服务稳定运行中",
+    "title_en": "Service running normally",
+    "body_zh": "如遇连接问题，客户端会自动切换线路。",
+    "body_en": "If you hit connection issues, the client will switch routes automatically.",
+    "published_at": "2026-06-13T00:00:00Z"
+  }
+}