feat: on-demand property/brand refresh + discovery improvements

[bokelley]

Summary

• Refresh buttons on property-viewer and brand-viewer pages so members can trigger immediate re-crawl of adagents.json and brand.json (resolves escalation Add Deals Protocol for inventory package discovery and activation (formerly known as Curation Protocol) #218 — gatavo.com not visible despite valid adagents.json)
• New endpoint POST /api/registry/brand-crawl-request for on-demand brand.json re-crawl, matching existing crawl-request pattern
• Auto-crawl when members add publisher domains to their profile (with SSRF validation + rate cap)
• Enqueue verified WorkOS domains into catalog_crawl_queue for the 30-minute discovery cycle
• Shared SSRF utility validateCrawlDomain() in url-security.ts — uses existing validateHostResolution (IPv4+IPv6 checks) instead of inline IPv4-only DNS check
• crawlSingleDomain now also scans brand.json via extracted scanBrandForDomain() method

Test plan

• TypeScript compiles cleanly
• All 565 unit tests pass
• Playwright browser tests: refresh buttons hidden when logged out, visible when logged in, click behavior correct (text changes, button disables, handles rate limit response)
• Local server testing: both endpoints return 202, rate limiting works (shared domain key), SSRF rejects private IPs and invalid domains, auth required
• Code review: addressed SSRF bypass in member-profiles, duplicate code extraction, domain normalization consistency
• Security review: addressed all Must Fix (SSRF on auto-crawl, unverified domain enqueue) and Should Fix (rate limit key namespace, domain format validation)

🤖 Generated with Claude Code