Platform operator console + multi-tenant hosts

SHIPPED 2026-07-04 (ADR 0032, fully done): firmary.app is the platform domain — /platform SaaS operator console, wildcard {slug}.os.firmary.app firm subdomains routed via Traefik with DNS-01 wildcard certs, and per-firm custom domains (jahncpa.com = Jahn CPA) with zero per-firm DNS/proxy work. Plus the platform-admin console (demo firms, impersonation walkthrough recipe).