docs: [#281] add issue specification and link issue to refactor plan

Author: josecelano

docs/issues/281-strengthen-domain-invariant-enforcement.md

@@ -0,0 +1,61 @@
+# Strengthen Domain Invariant Enforcement (DDD Refactor)
+
+**Issue**: [#281](https://github.com/torrust/torrust-tracker-deployer/issues/281)
+**Type**: Refactor
+**Status**: In Progress
+
+## Overview
+
+Apply the DDD validated constructor pattern to all domain configuration types, ensuring domain invariants are enforced at construction time rather than validated post-hoc.
+
+## Detailed Plan
+
+See: [`docs/refactors/plans/strengthen-domain-invariant-enforcement.md`](../refactors/plans/strengthen-domain-invariant-enforcement.md)
+
+## Related ADRs
+
+- [Validated Deserialization for Domain Types](../decisions/validated-deserialization-for-domain-types.md)
+- [TryFrom for DTO to Domain Conversion](../decisions/tryfrom-for-dto-to-domain-conversion.md)
+
+## Reference Implementation
+
+`HttpApiConfig` has been refactored as the reference implementation (Phase 0, Proposal #0):
+
+- Location: `src/domain/tracker/config/http_api.rs`
+- DTO: `src/application/command_handlers/create/config/tracker/http_api_section.rs`
+
+## Implementation Checklist
+
+### Phase 0: HTTP API Config ✅
+
+- [x] `HttpApiConfig` validated constructor with `HttpApiConfigError`
+- [x] Private fields with getter methods
+- [x] Custom `Deserialize` using `HttpApiConfigRaw`
+- [x] `TryFrom<HttpApiSection> for HttpApiConfig`
+- [x] Documentation and ADRs
+
+### Phase 1: Tracker Configuration Types
+
+- [ ] `UdpTrackerConfig` - validated constructor, private fields, getters
+- [ ] `HttpTrackerConfig` - validated constructor, private fields, getters
+- [ ] `HealthCheckApiConfig` - validated constructor, private fields, getters
+- [ ] `TryFrom` implementations for each DTO section
+
+### Phase 2: Cross-Cutting Invariants
+
+- [ ] `TrackerCoreConfig` - database configuration validation
+- [ ] `TrackerConfig` - validates at construction (socket conflicts)
+- [ ] `UserInputs` - validated constructor (Grafana requires Prometheus)
+
+## Acceptance Criteria
+
+- [ ] All domain configuration types use validated constructors
+- [ ] All fields are private with getter methods
+- [ ] All types implement custom `Deserialize` with validation
+- [ ] All DTO→Domain conversions use `TryFrom` trait
+- [ ] Validation logic moved from application to domain layer
+- [ ] Pre-commit checks pass: `./scripts/pre-commit.sh`
+
+## Contributing Guide
+
+See [`docs/contributing/ddd-practices.md`](../contributing/ddd-practices.md) for implementation patterns.

docs/refactors/active-refactorings.md

@@ -1,6 +1,6 @@
 # Active Refactoring Plans
 
-| Document                                                                                              | Status      | Issue | Target                                 | Created    |
-| ----------------------------------------------------------------------------------------------------- | ----------- | ----- | -------------------------------------- | ---------- |
-| [Simplify Controller Command Handler Creation](plans/simplify-controller-command-handler-creation.md) | 📋 Planning | TBD   | Remove unnecessary progress steps      | 2025-12-17 |
-| [Strengthen Domain Invariant Enforcement](plans/strengthen-domain-invariant-enforcement.md)           | 📋 Planning | TBD   | Enforce DDD invariants in domain layer | 2026-01-21 |
+| Document                                                                                              | Status         | Issue                                                                  | Target                                 | Created    |
+| ----------------------------------------------------------------------------------------------------- | -------------- | ---------------------------------------------------------------------- | -------------------------------------- | ---------- |
+| [Simplify Controller Command Handler Creation](plans/simplify-controller-command-handler-creation.md) | 📋 Planning    | TBD                                                                    | Remove unnecessary progress steps      | 2025-12-17 |
+| [Strengthen Domain Invariant Enforcement](plans/strengthen-domain-invariant-enforcement.md)           | 🚧 In Progress | [#281](https://github.com/torrust/torrust-tracker-deployer/issues/281) | Enforce DDD invariants in domain layer | 2026-01-21 |

docs/refactors/plans/strengthen-domain-invariant-enforcement.md

@@ -1,5 +1,7 @@
 # Strengthen Domain Invariant Enforcement
 
+**Issue**: [#281](https://github.com/torrust/torrust-tracker-deployer/issues/281)
+
 ## 📋 Overview
 
 This refactoring plan addresses DDD violations where domain types fail to enforce business invariants. Currently, some domain configuration types have public fields and lack validated constructors, allowing the creation of invalid domain objects. This undermines the core DDD principle that domain entities should be "always valid" after construction.