Resolve a domain to its owning org and any matching products

Normalizes the input domain (lowercased, no scheme/path/www), exact-matches against organizations.domain (primary) and domain_aliases.domain (alias for either an org or a product), and returns whatever it finds.

On a complete miss, when listing-self-serve-enabled is on, the handler may probe https://{domain}/.well-known/releases.json in-request and materialize a stub org (basis: declared) via the same core as the listing activate path and the domain-demand cron. Probe budget is per-domain (a few attempts per ~10 min rolling window) plus a per-IP rate limit on the outbound branch; budget exhaustion returns 404 (not 429). Misses still record domain_demand for the nightly sweep backstop.

Products can be populated even when org is null — a product alias may point at a domain its parent org doesn't claim as primary.