test(matrix): W4 stacks-advanced block integration suite (move exempt→mapped) (#256)

Close the eight /api/v1/stacks/:slug/* advanced routes carried as
routeCoverageExemptions in the done-bar guard, moving them exempt→mapped
with a DB-backed handler-integration suite:

  POST/DELETE /api/v1/stacks/:slug/confirm-deletion  (tokenized two-step delete)
  POST        /api/v1/stacks/:slug/promote           (env-promote approval gate)
  GET         /api/v1/stacks/:slug/family            (Pro-gated env-family read)
  POST/GET    /api/v1/stacks/:slug/domains           (custom-domain add/list)
  POST        /api/v1/stacks/:slug/domains/:id/verify
  DELETE      /api/v1/stacks/:slug/domains/:id

New suite internal/handlers/stacks_advanced_block_integration_test.go drives
each route through the production RequireAuth + /api/v1 group
(newStacksAdvancedApp mirrors router.go) against a real Postgres
(testhelpers.SetupTestDB). Asserts the real contract per handler (rule 16):
confirm-deletion is tokenized + single-use (410 replay, 410 cross-team token);
promote validates env (invalid_env/invalid_target/env_mismatch) and short-
circuits a non-dev target to 202 pending_approval + a promote_approvals row
before any compute; family stamps Cache-Control: private, max-age=60; domains
create→list→verify(TXT seam)→delete round-trips + per-count/feature tier gates.
Plus the authz axes: owner+member (same team_id) 2xx, non-member cross-team 404
(never 403), unauth 401, off-tier 402. The external DNS/cert-manager ingress+
cert legs need a live k8s and are asserted only up to the verified state (k8s
nil) — deferred to the W4 custom-domain e2e spec. No handler-source edits; no
helper redefined. PATCH /stacks/:slug/env stays exempt (out of this scope).

Both done-bar guards green (TestDoneBar_EveryRouteCovered +
TestDoneBar_TestMapPointsAtRealTests). mapped 98→106, exempt 73→65.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805