refactor(zone): remove legacy route domain storage

第二阶段清理：删除 of_managed_domains 与 of_proxy_routes 冗余域名/证书列，
移除 ManagedDomain 模型与 API、路由侧 legacy 字段维护，以及前端 WebsiteService。
ImportLegacy 在旧列/旧表缺失时跳过对应源，保持幂等。

internal/apps/openflare/tls/logics_test.go

@@ -42,7 +42,6 @@ func setupTLSTestDB(t *testing.T) func() {
 		&model.TLSCertificate{},
 		&model.Zone{},
 		&model.ZoneDomain{},
-		&model.ManagedDomain{},
 		&model.DNSAccount{},
 		&model.AcmeAccount{},
 		&model.TaskExecution{}, // 异步任务执行记录也需要 migrate
@@ -111,54 +110,6 @@ func generateTestCertificatePair(t *testing.T, dnsNames []string) (string, strin
 	return string(certPEM), string(keyPEM)
 }
 
-func TestCreateManagedDomain(t *testing.T) {
-	cleanup := setupTLSTestDB(t)
-	defer cleanup()
-	ctx := context.Background()
-
-	certPEM, keyPEM := generateTestCertificatePair(t, []string{"api.example.com"})
-	certificate, err := CreateCertificate(ctx, CertificateInput{
-		Name:    "api-cert",
-		CertPEM: certPEM,
-		KeyPEM:  keyPEM,
-	})
-	require.NoError(t, err)
-
-	certID := certificate.ID
-	domain, err := CreateManagedDomain(ctx, ManagedDomainInput{
-		Domain:  "api.example.com",
-		CertID:  &certID,
-		Enabled: true,
-		Remark:  "primary api",
-	})
-	require.NoError(t, err)
-	assert.NotZero(t, domain.ID)
-	assert.Equal(t, "api.example.com", domain.Domain)
-	assert.Equal(t, certID, *domain.CertID)
-	assert.True(t, domain.Enabled)
-	assert.Equal(t, "primary api", domain.Remark)
-
-	_, err = CreateManagedDomain(ctx, ManagedDomainInput{
-		Domain:  "api.example.com",
-		Enabled: true,
-	})
-	require.Error(t, err)
-	assert.Equal(t, errManagedDomainExists, err.Error())
-}
-
-func TestCreateManagedDomainRejectsInvalidWildcard(t *testing.T) {
-	cleanup := setupTLSTestDB(t)
-	defer cleanup()
-	ctx := context.Background()
-
-	_, err := CreateManagedDomain(ctx, ManagedDomainInput{
-		Domain:  "*.*.example.com",
-		Enabled: true,
-	})
-	require.Error(t, err)
-	assert.Equal(t, errManagedDomainWildcardInvalid, err.Error())
-}
-
 func TestCreateCertificateEncryptsPrivateKey(t *testing.T) {
 	cleanup := setupTLSTestDB(t)
 	defer cleanup()