Domain Onboarding Pipeline
1. Extract domains from CSV → deduplicate against existing zones
2. Create zones in batches of ~40-50 (pending limit). 2s delay between, 5s pause every 15.
3. Each batch gets unique NS pair assigned by CF (jakub/magali, natasha/sid, etc.)
4. Update NS at registrar to EXACT pair assigned (not just "any Cloudflare NS")
5. Trigger activation_check via API after NS update
6. Wire Worker Custom Domains (root + www) for each activated zone
7. UPDATE D1 status = 'active'
8. Verify: /api/status, themed page, beacon, agent.json
⚠ Critical Gotchas
• Old CF NS ≠ new CF NS — domains may show "cloudflare" but wrong pair
• Rate limit (code 971): pause 90s+ and retry
• Pending zone limit (~50): must activate before creating more
• service_catalog can be objects or strings — handle both in templates
• SQLite UPDATE doesn't support ORDER BY/LIMIT — use subquery