Service discovery from a bare domain

[zealsprince]

"Users enter only a domain" is the spec's discovery promise, and no ticket implements the resolution algorithm.

Implement it per Deployment: SRV where the platform provides a resolver, the well-known JSON file everywhere, manual entry as the last resort - with absent services silently hiding their UI rather than erroring.

Spec:

• Deployment - the resolution algorithm and record definitions
• Infrastructure - the discovery surface and degradation rules
• Platform - the resolver port

Acceptance criteria:

• A domain with SRV records resolves fully on desktop without a well-known file
• A domain with only the well-known file resolves on the web client
• A missing service hides its surface with no error shown
• Only when every applicable path is exhausted does the user see one actionable error

Blocked by the platform contract alignment (#36).