Method VerifyDomain

internal/identity/store.go:734–747

VerifyDomain marks a domain as verified, only if owned by the given user.

(ctx context.Context, domain, userID string)

// VerifyDomain marks a domain as verified, only if owned by the given user.
func (s *Store) VerifyDomain(ctx context.Context, domain, userID string) error {
	tag, err := s.pool.Exec(ctx,
		`UPDATE domains SET verified = true, verified_at = now()
		 WHERE domain = $1 AND user_id = $2 AND verified = false`,
		normalizeDomain(domain), userID,
	)
	if err != nil {
		return err
	}
	if tag.RowsAffected() == 0 {
		return fmt.Errorf("domain not found, not owned by user, or already verified")
	}
	return nil
}

// ListDomainsByUser returns all domains owned by the user (excludes system rows).
// AgentCount is computed inline via a correlated subquery — one round-trip