Harden compliance portal auth and TLS

Align console references and OAuth branding with the
compliance-page model, and fix certificate cache eviction,
portal OAuth handlers, and magic-link edge cases left after
the trust-center rename.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/slug/slug.go

@@ -46,6 +46,8 @@ func Make(s string) string {
 }
 
 func MakeWithEntropy(s string) string {
+	const maxDNSLabel = 63
+
 	base := Make(s)
 	suffix := rand.MustHexString(4)
 
@@ -53,5 +55,18 @@ func MakeWithEntropy(s string) string {
 		return suffix
 	}
 
+	// DNS labels are capped at 63 octets. Keep the entropy suffix and
+	// truncate the name-derived prefix so hostnames stay provisionable.
+	maxBase := maxDNSLabel - 1 - len(suffix)
+	if maxBase < 1 {
+		return suffix
+	}
+	if len(base) > maxBase {
+		base = strings.Trim(base[:maxBase], "-")
+		if base == "" {
+			return suffix
+		}
+	}
+
 	return base + "-" + suffix
 }