Require verified certs for portal redirect hosts

AddCustomDomain only validates the domain's format before inserting
the row; certificate issuance then runs asynchronously. Every host
that row resolved to was accepted by the OIDC, magic-link, and
compliance-portal OAuth `continue` redirect allowlists, so anyone
could self-register an org, claim an arbitrary domain, and have
users redirected there right after a real login. Found while
re-checking GHSA-r9mf-88r7-g6j9 against the compliance portal
rework: the original session-transfer leak is gone, but this open
redirect on the same allowlist was not.

Gate those allowlists on the domain's certificate having reached
Active or Renewing status, which only happens once DNS has pointed
at Probo's edge and an ACME challenge has actually succeeded.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/api.go

@@ -257,9 +257,7 @@ func NewServer(cfg Config) (*Server, error) {
 					return true
 				}
 
-				_, err := cfg.Visitor.GetPortalByDomainName(ctx, host)
-
-				return err == nil
+				return cfg.Visitor.IsVerifiedRedirectHost(ctx, host)
 			},
 			cfg.GraphQLLimits,
 		),