Surface domain provisioning errors to users

When DNS verification, CAA checks, or HTTP challenge completion
fail during certificate provisioning, the error is now stored on
the custom domain record and exposed via GraphQL. The console
displays it in both the domain card and domain detail dialog so
users can diagnose configuration issues without checking logs.

Previously these failures returned an error that was only logged
server-side, leaving users with no visibility into why their
domain was stuck in a pending state.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

apps/console/src/pages/organizations/compliance-page/domain/_components/CompliancePageDomainCard.tsx

@@ -30,6 +30,7 @@ const fragment = graphql`
   fragment CompliancePageDomainCardFragment on CustomDomain {
     domain
     sslStatus
+    provisioningError
     canDelete: permission(action: "core:custom-domain:delete")
     ...CompliancePageDomainDialogFragment
   }
@@ -52,7 +53,9 @@ export function CompliancePageDomainCard(props: { fKey: CompliancePageDomainCard
               <div className="text-sm text-txt-secondary">
                 {domain.sslStatus === "ACTIVE"
                   ? __("Verified")
-                  : __("Pending verification")}
+                  : domain.provisioningError
+                    ? domain.provisioningError
+                    : __("Pending verification")}
               </div>
             </div>
             <Badge

apps/console/src/pages/organizations/compliance-page/domain/_components/CompliancePageDomainDialog.tsx

@@ -35,6 +35,7 @@ const fragment = graphql`
   fragment CompliancePageDomainDialogFragment on CustomDomain {
     sslStatus
     domain
+    provisioningError
     dnsRecords {
       type
       name
@@ -115,6 +116,13 @@ export function CompliancePageDomainDialog(props: CompliancePageDomainDialogProp
             )
           : (
               <div>
+                {domain.provisioningError && (
+                  <div className="bg-danger-subtle text-danger rounded-lg p-4 mb-4">
+                    <p className="text-sm font-medium mb-1">{__("Provisioning error")}</p>
+                    <p className="text-sm">{domain.provisioningError}</p>
+                  </div>
+                )}
+
                 <h4 className="font-medium mb-3">{__("DNS Configuration")}</h4>
                 <p className="text-sm text-txt-secondary mb-4">
                   {__(