Caddy On-Demand TLS ask authorization endpoint.

Returns `200 {"authorized": true}` when `host` matches a published+enabled `custom_domain_mapping` row (design §4.2.2 ask / §5.1 effectiveness rule); `404` on a miss (Caddy declines TLS issuance); `401` when the `X-Herald-Ask-Key` header is missing or mismatches the configured shared secret. Never exposes realm information — this is a certificate-abuse gate.

curl -X GET "https://example.com/api/internal/custom-domain/authorize?host=string"

{  "authorized": true}

{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}

{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}

{  "code": "string",  "details": null,  "message": "string",  "requestId": "string",  "status": 0}