refactor(web): select route domains from zones

反代路由创建/域名配置改为绑定 zone_domain_ids，移除手写域名列表与
旧证书字段；列表与 WAF/UptimeKuma 消费端同步读取 zone_domains。

frontend/app/(main)/proxy-routes/detail/components/domain-section.tsx

@@ -10,17 +10,12 @@ import {Form, FormControl, FormDescription, FormField, FormItem, FormLabel, Form
 import {Input} from '@/components/ui/input';
 import {Switch} from '@/components/ui/switch';
 import type {ProxyRouteItem} from '@/lib/services/openflare';
-import {TlsCertificateService, WebsiteService} from '@/lib/services/openflare';
+import {ZoneService, zoneQueryKey} from '@/lib/services/openflare';
 
-import {validateDomains} from '../../components/helpers';
-import {
-  buildDomainCertificateIDs,
-  buildDomainRows,
-  normalizeSelectedCertificateIDs,
-  proxyRouteFormIds,
-} from '../helpers';
+import {listAllZoneDomains} from '../../components/helpers';
+import {ZoneDomainSelector} from '../../components/zone-domain-selector';
+import {proxyRouteFormIds} from '../helpers';
 import {useRouteSectionSave} from '../hooks/use-route-section-save';
-import {DomainListInput} from './domain-list-input';
 import {SectionShell} from './section-shell';
 
 const domainSettingsSchema = z
@@ -30,42 +25,9 @@ const domainSettingsSchema = z
       .trim()
       .min(1, '请输入站点标识')
       .max(255, '站点标识不能超过 255 个字符'),
-    domain_rows: z
-      .array(
-        z.object({
-          domain: z.string(),
-          certificateId: z.string(),
-        }),
-      )
-      .min(1),
+    zone_domain_ids: z.array(z.number().int().positive()).min(1, '请至少选择一个域名'),
     enabled: z.boolean(),
     redirect_http: z.boolean(),
-  })
-  .superRefine((value, context) => {
-    const domains = value.domain_rows
-      .map((item) => item.domain.trim().toLowerCase())
-      .filter(Boolean);
-    const error = validateDomains(domains);
-    if (error) {
-      context.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ['domain_rows'],
-        message: error,
-      });
-    }
-
-    const selectedCertificateCount = new Set(
-      value.domain_rows
-        .map((item) => Number(item.certificateId))
-        .filter((item) => Number.isFinite(item) && item > 0),
-    ).size;
-    if (value.redirect_http && selectedCertificateCount === 0) {
-      context.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ['redirect_http'],
-        message: '启用 HTTP 跳转前，请先为域名选择证书',
-      });
-    }
   });
 
 type DomainSettingsValues = z.infer<typeof domainSettingsSchema>;
@@ -79,21 +41,21 @@ interface DomainSectionProps {
 export function DomainSection({ route, onRouteUpdate, onSavingChange }: DomainSectionProps) {
   const { saving, save } = useRouteSectionSave(route, onRouteUpdate, onSavingChange);
 
-  const certificatesQuery = useQuery({
-    queryKey: ['openflare', 'tls-certificates'],
-    queryFn: () => TlsCertificateService.list(),
+  const zonesQuery = useQuery({
+    queryKey: zoneQueryKey,
+    queryFn: () => ZoneService.list(),
   });
 
-  const managedDomainsQuery = useQuery({
-    queryKey: ['openflare', 'managed-domains'],
-    queryFn: () => WebsiteService.list(),
+  const domainsQuery = useQuery({
+    queryKey: [...zoneQueryKey, 'all-domains'],
+    queryFn: () => listAllZoneDomains(),
   });
 
   const form = useForm<DomainSettingsValues>({
     resolver: zodResolver(domainSettingsSchema),
     defaultValues: {
       site_name: route.site_name,
-      domain_rows: buildDomainRows(route),
+      zone_domain_ids: route.zone_domain_ids ?? [],
       enabled: route.enabled,
       redirect_http: route.redirect_http,
     },
@@ -102,26 +64,47 @@ export function DomainSection({ route, onRouteUpdate, onSavingChange }: DomainSe
   useEffect(() => {
     form.reset({
       site_name: route.site_name,
-      domain_rows: buildDomainRows(route),
+      zone_domain_ids: route.zone_domain_ids ?? [],
       enabled: route.enabled,
       redirect_http: route.redirect_http,
     });
   }, [form, route]);
 
-  const domainSuggestionSources = useMemo(
-    () => [
-      ...(route.domains ?? []),
-      ...(managedDomainsQuery.data?.map((item) => item.domain) ?? []),
-    ],
-    [managedDomainsQuery.data, route.domains],
-  );
+  const selectedIDs = form.watch('zone_domain_ids');
+  const selectedDomains = useMemo(() => {
+    const fromApi = domainsQuery.data ?? [];
+    const byId = new Map(fromApi.map((domain) => [domain.id, domain]));
+    // Prefer live catalog; fall back to route-bound domains for display before catalog loads.
+    return selectedIDs
+      .map((id) => {
+        const catalog = byId.get(id);
+        if (catalog) {
+          return catalog;
+        }
+        const bound = (route.zone_domains ?? []).find((item) => item.id === id);
+        if (!bound) {
+          return null;
+        }
+        return {
+          id: bound.id,
+          zone_id: bound.zone_id,
+          proxy_route_id: route.id,
+          domain: bound.domain,
+          cert_id: bound.cert_id,
+          remark: '',
+          created_at: '',
+          updated_at: '',
+        };
+      })
+      .filter((item): item is NonNullable<typeof item> => item != null);
+  }, [domainsQuery.data, route.id, route.zone_domains, selectedIDs]);
 
-  const selectedCertificateIDs = normalizeSelectedCertificateIDs(form.watch('domain_rows'));
+  const hasCertificate = selectedDomains.some((domain) => domain.cert_id != null);
 
   return (
     <SectionShell
       title="域名设置"
-      description="在一个列表里同时维护域名、证书和 HTTPS 跳转。保存时会自动汇总站点证书集合。"
+      description="绑定已在 Zone 中注册的 FQDN。证书请在 Zone 域名管理中维护。"
       formId={proxyRouteFormIds.domains}
       saving={saving}
     >
@@ -130,23 +113,20 @@ export function DomainSection({ route, onRouteUpdate, onSavingChange }: DomainSe
           id={proxyRouteFormIds.domains}
           className="space-y-5"
           onSubmit={form.handleSubmit(async (values) => {
-            const domains = values.domain_rows
-              .map((item) => item.domain.trim().toLowerCase())
-              .filter(Boolean);
-            const domainCertIDs = buildDomainCertificateIDs(values.domain_rows);
-            const certIDs = normalizeSelectedCertificateIDs(values.domain_rows);
+            if (values.redirect_http && !hasCertificate) {
+              form.setError('redirect_http', {
+                message: '启用 HTTP 跳转前，请先为所选域名绑定证书（在 Zone 中配置）',
+              });
+              return;
+            }
 
             await save(
               {
                 site_name: values.site_name.trim(),
-                domain: domains[0],
-                domains,
+                zone_domain_ids: values.zone_domain_ids,
                 enabled: values.enabled,
-                enable_https: certIDs.length > 0,
-                cert_id: certIDs[0] ?? null,
-                cert_ids: certIDs,
-                domain_cert_ids: domainCertIDs,
-                redirect_http: certIDs.length > 0 ? values.redirect_http : false,
+                enable_https: hasCertificate,
+                redirect_http: hasCertificate ? values.redirect_http : false,
               },
               '域名设置已保存',
             );
@@ -185,21 +165,22 @@ export function DomainSection({ route, onRouteUpdate, onSavingChange }: DomainSe
 
           <FormField
             control={form.control}
-            name="domain_rows"
+            name="zone_domain_ids"
             render={({ field }) => (
               <FormItem>
-                <FormLabel>域名列表</FormLabel>
+                <FormLabel>绑定域名</FormLabel>
                 <FormControl>
-                  <DomainListInput
-                    rows={field.value}
+                  <ZoneDomainSelector
+                    value={field.value}
                     onChange={field.onChange}
-                    onBlur={field.onBlur}
-                    suggestionSources={domainSuggestionSources}
-                    certificates={certificatesQuery.data ?? []}
+                    domains={domainsQuery.data ?? []}
+                    zones={zonesQuery.data ?? []}
+                    currentRouteId={route.id}
+                    disabled={domainsQuery.isLoading}
                   />
                 </FormControl>
                 <FormDescription>
-                  每行配置一个域名。可为不同域名选择不同证书，托管域名将自动匹配证书。
+                  仅选择绑定关系；证书与 FQDN 请到对应 Zone 详情页管理。
                 </FormDescription>
                 <FormMessage />
               </FormItem>
@@ -214,15 +195,15 @@ export function DomainSection({ route, onRouteUpdate, onSavingChange }: DomainSe
                 <div className="space-y-0.5">
                   <FormLabel>HTTP 自动跳转到 HTTPS</FormLabel>
                   <FormDescription>
-                    {selectedCertificateIDs.length > 0
+                    {hasCertificate
                       ? '开启后会额外生成 80 端口重定向规则。'
-                      : '至少为一个域名选择证书后才能启用。'}
+                      : '所选域名至少绑定一张证书后才能启用。'}
                   </FormDescription>
                 </div>
                 <FormControl>
                   <Switch
                     checked={field.value}
-                    disabled={selectedCertificateIDs.length === 0}
+                    disabled={!hasCertificate}
                     onCheckedChange={field.onChange}
                   />
                 </FormControl>