perf(worker): keyset-paginate quota-wall-nudge + custom-domain reconciler scans

[mastermanas805]

What

Two more periodic reconciler scans converted to keyset pagination, mirroring
the already-merged fetchLiveStackIDs loop in orphan_sweep_reconciler.go:

• QuotaWallNudgeWorker.Work (quota_wall_nudge.go) — SELECT id, plan_tier FROM teams WHERE plan_tier NOT IN (team, anonymous, free)
• CustomDomainReconciler.listActiveDomains (custom_domain_reconcile.go) —
  SELECT ... FROM custom_domains WHERE status NOT IN (live, failed)

Each scan still evaluates the WHOLE eligible set every tick — not a bare
LIMIT that drops rows.

Coverage block

Symptom:        unbounded full-table SELECT in 2 reconciler scans
Enumeration:    rg 'FROM teams|FROM custom_domains' internal/jobs/quota_wall_nudge.go internal/jobs/custom_domain_reconcile.go
Sites found:    2  (QuotaWallNudgeWorker.Work, listActiveDomains)
Sites touched:  2
Coverage test:  TestQuotaWallNudge_KeysetPagination/_SecondPageError/
                _KeysetRowsErr + TestCustomDomain_ListActiveDomains_*
Live verified:  worker auto-deploys on merge to master; verify via kubectl
                image SHA + /healthz commit_id (rule 14) post-merge

Notes

• Batch sizes: quota_wall_nudge=1000 (cheap id+tier projection); custom_domain
  =100 (small — each row triggers an outbound DNS TXT lookup / HTTP HEAD probe,
  so a tight batch bounds each tick's network fan-out).
• Keyset over OFFSET: rides the PK, restart-safe, no re-scan/drift under the
  concurrent status flips / tier changes each reconciler performs.
• custom_domain ORDER BY moves created_at → id::text; the caller explicitly
  does not depend on order ("purely for log readability").
• All side effects preserved (wall-nudge: 24h dedupe + 3-axis evaluate +
  one-row-per-team insert; custom_domain: full reconcile loop).
• make gate green locally.

🤖 Generated with Claude Code