Adds one domain to the deployment's applicable verified set. Federated logins are
admitted only when the domain they derive is a member of that set, compared as
exact equality over the normalized label — never a suffix match, so

declaring acme.com does NOT admit evil-acme.com or
acme.com.attacker.test.

On this plane declaring is verifying: the row is written
verified = true with verificationMethod = PLATFORM_ADMIN,

and verifiedBy is taken from the security context. There is no DNS
challenge and no verify verb (PRD §136 D7).

Re-declaring a domain already in the set is a no-op that returns the existing row —
the operator's intent is already satisfied, and a 409 would send them to diagnose a
conflict that does not exist.