Fix storefront SSL probes and per-domain ensure for dashboards.

Skip redundant provision on edit, harden TLS hostname checks, and issue apex/business/customer SSL from one endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/business-admin/business-admin.service.ts

@@ -583,7 +583,14 @@ export class BusinessAdminService {
     let provisionError: string | null = null;
     let nextGitRepoUrl = domain.gitRepoUrl;
 
-    if (gitRepoUrl) {
+    // Only provision when wiring a new/changed repo or when deploy slug is missing.
+    // Re-saving the same git URL must not block the API on clone/nginx/certbot again.
+    const alreadyWired =
+      !!gitRepoUrl &&
+      !!domain.deploySlug?.trim() &&
+      domain.gitRepoUrl?.trim() === gitRepoUrl;
+
+    if (gitRepoUrl && !alreadyWired) {
       const slug = domain.deploySlug?.trim() || deploySlugFromHost(host);
       if (!slug) {
         throw new BadRequestException('Could not derive deploy slug from host');
@@ -612,6 +619,9 @@ export class BusinessAdminService {
           provisionError = 'Storefront provision failed on websites server';
         }
       }
+    } else if (alreadyWired) {
+      deploySlug = domain.deploySlug;
+      nextGitRepoUrl = gitRepoUrl;
     }
 
     const updated = await this.prisma.domain.update({