feat(platform): Add regional delivery and managed HTTPS

[yuanzui-cf]

Summary

Deployments can select a region and are scheduled onto healthy Serve nodes with capacity in that region. Every Serve node retains the full Host route snapshot and can reach the assigned deployment through one peer hop, including across regions.

Regional CNAME entries support verified custom-domain HTTPS. TXT ownership and domain review gate serving and issuance; Node TLS selects certificates by SNI, enforces Host matching, and reloads renewed certificates. The Control API and Console manage Let's Encrypt, ZeroSSL EAB, HTTP-01 publication acknowledgements, delegated DNS-01, manual imports, renewal retries, entry health, and certificate installation status. Additive migrations store encrypted certificate state and Node acknowledgements.

Gateway requests follow the destination's authentication mode, covering all four token/trusted-network combinations. DNSPod, Route53, and Cloudflare reconciliation preserve unrelated TXT values and encrypt write-only provider credentials. Dependency updates address the HTTP/2 empty-frame and test-server path-traversal advisories. Deployment documentation includes native TLS configuration and a HAProxy TCP passthrough example.

The integration preserves the original commits from #185 and #186 as merge parents. The implementation files remain identical to the previously validated 79080b19; the only file change in the integration commit removes completed capabilities from docs/todo.md. Merge this PR into develop with a merge commit so all three source branch histories enter the base branch and GitHub can mark the related PRs as merged.

Validation

• just quality passed on the final integration tree before commit: 483 Control API tests, 117 Node tests, and 225 Console tests, plus formatting, lint, checks, production builds, and license validation. Infrastructure-dependent ignored tests are covered separately by CI where configured.
• The Node Serve suite also passed 50 targeted local tests, including native HTTPS, certificate replacement/withdrawal, entry failover, all four gateway authentication combinations, and redirect/traversal protections.
• Prior integrated CI passed the suites, dependency audits, migration application, explicit certificate schema inspection, regional ingress migration upgrade/rollback, and Docker Node delivery smoke test.
• Verified that the original heads of both related feature branches are ancestors of the integration commit and that all files other than the TODO match 79080b19 exactly.
• Final integration CI passed both Quality and Node delivery smoke for 982c5d58, including migration/schema checks and dependency audits.

Tracking

Parent: #179

Related PRs: #185 and #186, both targeting develop and integrated through this PR.

Closes #180
Closes #181
Closes #182
Closes #183

The default branch is main; repeat these closing references in the later promotion PR from develop to main.

Known Limitations

• Live DNS provider operations and public Let's Encrypt/ZeroSSL issuance have not been exercised with dedicated domains and runtime credentials. Provider contract tests and a local ACME CA provide the available automated coverage.
• Standalone tsc --noEmit fails on the existing Console setup because React/Node type dependencies are missing; the same failure was reported on the unchanged develop baseline. Standard vp check, tests, and production builds pass.
• Automatic deployment relocation after the assigned Serve node fails remains separate work. Entry failover assumes the assigned Serve node remains healthy.