feat: unified URL resolution with 5-level fallback chain and multi-tenant subdomain support

[nap-liu]

Summary

• New domain.py: resolve_base_url() with 5-level fallback (tenant sso_domain → subdomain_prefix → DB setting → ENV → request)
• Enhanced platform_service.py: added DB system_settings lookup
• Tenant model: added subdomain_prefix and is_default fields + alembic migrations
• New API endpoints: check-prefix, enhanced resolve-by-domain with default tenant fallback
• Frontend: Public Base URL config in Platform Settings (with i18n zh/en)

Test plan

• check-prefix: available/reserved correctly
• resolve-by-domain: returns default tenant with new fields
• system-settings read/write
• alembic migration chain verified
• Frontend: i18n "公开访问地址" confirmed

[nap-liu]

Pushed an update addressing all three blockers from the bundle review.

1. Alembic dual-head — add_subdomain_prefix now chains from f1a2b3c4d5e6 (the A2A migration), so the migration chain is linear again.

2. sso_domain comparison — you were right; the earlier direct sso_domain == hostname compare was a regression. Restored upstream's protocol-prepend loop so existing full-URL values like https://acme.example.com still match.

3. Fallback risk — dropped both the wildcard slug match (hostname.split('.')[0]) and the default-tenant fallback. Resolution now only succeeds on explicitly configured values:

1. sso_domain with protocol prepended
2. sso_domain port-stripped
3. subdomain_prefix — strictly matches {prefix}.{platform_base_host} (platform_base_host comes from system_settings / env; prefix cannot contain a dot)
4. Legacy {slug}.clawith.ai hardcoded pattern (upstream behavior, unchanged)

Also restored the is_active AND sso_enabled exit check that was accidentally dropped.

Net diff vs upstream: +306 / -24 (down from +319 / -67), mostly additive now.

HEAD: b749c8e