Add a custom domain to a Deno Deploy app and provision its TLS certificate

Documented steps

1. Auth: Dashboard login at console.deno.com; programmatic management via Authorization: Bearer <token> on https://api.deno.com /v2/domains endpoints.
2. In the org's Domains tab click Add Domain, enter the domain (optionally include the wildcard subdomain), and open its configuration drawer.
3. Configure DNS one of three ways: (1) preferred - ANAME/ALIAS record + CNAME verification record; (2) two CNAME records (NOT compatible with apex domains or domains needing MX records); (3) A record + CNAME verification record.
4. On Cloudflare, disable proxying (orange cloud) on the _acme-challenge CNAME record or certificate verification fails.
5. Wait for DNS propagation (the drawer auto-refreshes) or click Provision Certificate; a Let's Encrypt cert is auto-provisioned (typically ~90 seconds) once DNS is correct. You can instead upload your own PEM cert and key.
6. Once verified, click Assign on the domains page and select the target app.
7. Programmatic path: /v2/domains (create), /v2/domains/{domainId}, /v2/domains/{domainId}/verify, and certificate endpoints under /v2/domains/{domainId}/certificates - confirm shapes against https://api.deno.com/v2/openapi.json.
8. Official docs: https://docs.deno.com/deploy/reference/domains/ ; https://api.deno.com/v2/openapi.json