Surface domain provisioning errors to users

When DNS verification, CAA checks, or HTTP challenge completion
fail during certificate provisioning, the error is now stored on
the custom domain record and exposed via GraphQL. The console
displays it in both the domain card and domain detail dialog so
users can diagnose configuration issues without checking logs.

Previously these failures returned an error that was only logged
server-side, leaving users with no visibility into why their
domain was stuck in a pending state.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/console/v1/graphql/trust_center.graphql

@@ -471,6 +471,7 @@ type CustomDomain implements Node {
     domain: String!
     sslStatus: SSLStatus!
     sslExpiresAt: Datetime
+    provisioningError: String
     dnsRecords: [DNSRecordInstruction!]!
     createdAt: Datetime!
     updatedAt: Datetime!

pkg/server/api/console/v1/types/custom_domain.go

@@ -24,11 +24,12 @@ func NewCustomDomain(d *coredata.CustomDomain, cnameTarget string) *CustomDomain
 		Organization: &Organization{
 			ID: d.OrganizationID,
 		},
-		Domain:       d.Domain,
-		SslStatus:    d.SSLStatus,
-		CreatedAt:    d.CreatedAt,
-		UpdatedAt:    d.UpdatedAt,
-		SslExpiresAt: d.SSLExpiresAt,
+		Domain:            d.Domain,
+		SslStatus:         d.SSLStatus,
+		CreatedAt:         d.CreatedAt,
+		UpdatedAt:         d.UpdatedAt,
+		SslExpiresAt:      d.SSLExpiresAt,
+		ProvisioningError: d.ProvisioningError,
 	}
 
 	// Convert DNS records