Member-facing Linked Domains UI (self-service)

[bokelley]

Context

Today the only Linked Domains management UI lives in admin-account-detail.html (admin-only, via `PUT /api/admin/organizations/:orgId/domains/:domain/primary`). Members can't:

• See their WorkOS-linked domains
• Add a second domain
• Choose which is primary
• Remove a stale verified domain

The brand-claim flow (`request_brand_domain_challenge` / `verify_brand_domain_challenge`) covers a different case (publishing brand.json on a domain you own but haven't linked via SSO). Most members shouldn't need that for the common case where their WorkOS email domain is their brand.

Scope

Add a Linked Domains card to `server/public/member-profile.html` mirroring the admin one. Reuse existing endpoints; expose user-scoped versions:

• `GET /api/me/organization/domains` — list verified WorkOS-sourced domains
• `POST /api/me/organization/domains` — request a new domain verification (delegates to WorkOS)
• `PUT /api/me/organization/domains/:domain/primary` — set primary (writes both `organization_domains.is_primary` and `member_profiles.primary_brand_domain` for the common case)
• `DELETE /api/me/organization/domains/:domain` — remove

Auth: org-membership role check (owner/admin), not admin-API.

Driver

Media.net escalation #321. The full thread / staging plan: Stage 2 of the cleanup discussed there. PR #4157 is Stage 1 (auto-populate from WorkOS).

Acceptance

• Member-profile page shows verified domains with Set Primary / Remove
• "Add domain" flow kicks off WorkOS verification
• Setting primary updates both org-membership-inference and brand-identity fields coherently (don't make the user click twice)
• Non-admin members see read-only view; only owners/admins can mutate

[bokelley]

Triage

Classification: Feature request
Bucket(s): member-tools
Status: deferred

Blocked-on: #4157 — resurfaces on merge

---

Triaged by Claude Code. Session: https://claude.ai/code/session_01ADzbeKnqMsLLrF9NQw7ZQA

---

Generated by Claude Code