bbs.profullstack.com launch kit: provisioner, custom domains, email verify, ascii-live

- setup.sh: idempotent one-shot droplet provisioner — agentbbs on :22
  (admin OpenSSH moved to :2202), rootless podman, Caddy front end for
  https://bbs.profullstack.com with tilde-style /~user homepages
- internal/sites + domain@ SSH route: self-service custom domains
  (ssh domain@host add example.com) backed by a symlink farm and an
  on-demand-TLS ask endpoint so Caddy only issues certs for mapped hosts
- internal/mail + join@ email verification: optional email at signup,
  confirmation link served by a loopback /verify endpoint behind Caddy
- internal/source + cmd/ascii-live: live video → terminal ASCII groundwork
  (docs/ascii-live.md)
- store: additive sqlite migrations (email/verify columns, domains table)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/auth/auth.go

@@ -36,6 +36,10 @@ var PodNames = map[string]bool{"pod": true}
 // visitor's public key, print instructions, and disconnect.
 var JoinNames = map[string]bool{"join": true, "signup": true, "register": true}
 
+// DomainNames are usernames that route to the custom-domain self-service flow:
+// list/add/remove the domains pointed at a member's homepage.
+var DomainNames = map[string]bool{"domain": true, "domains": true}
+
 // IsGuestName reports whether the SSH username requests anonymous hub access.
 func IsGuestName(u string) bool { return GuestNames[strings.ToLower(u)] }
 
@@ -45,6 +49,9 @@ func IsPodName(u string) bool { return PodNames[strings.ToLower(u)] }
 // IsJoinName reports whether the SSH username requests onboarding.
 func IsJoinName(u string) bool { return JoinNames[strings.ToLower(u)] }
 
+// IsDomainName reports whether the SSH username requests the custom-domain flow.
+func IsDomainName(u string) bool { return DomainNames[strings.ToLower(u)] }
+
 // KindFor infers the identity kind from a (non-guest) username.
 // Usernames prefixed "agent-" are automated clients (PRD §3).
 func KindFor(username string) Kind {