fix(migrator): only import zone domains during upgrade window

Zone 历史导入仅在 goose 版本位于 [202607120002, 202607130001) 时执行，
phase-2 删列完成后日常启动不再进入导入逻辑。

internal/db/migrator/migrator.go

@@ -36,8 +36,10 @@ const (
 	dialectSqlite   = "sqlite3"
 	dialectPostgres = "postgres"
 	// zoneImportSQLVersion is the goose SQL marker after of_zones creation and
-	// before drop of legacy route domain columns. Zone data import runs here.
+	// before drop of legacy route domain columns. Zone data import runs only
-	zoneImportSQLVersion int64 = 202607120002
+	// while DB version is in [zoneImportSQLVersion, zoneDropLegacySQLVersion).
+	zoneImportSQLVersion     int64 = 202607120002
+	zoneDropLegacySQLVersion int64 = 202607130001
 )
 
 func gooseDialect() string {
@@ -77,8 +79,10 @@ func Migrate() {
 	if err := goose.UpTo(sqlDB, migrationDir(), zoneImportSQLVersion); err != nil {
 		log.Fatalf("[%s] goose migrate (up to zone import) failed: %v\n", dbType(), err)
 	}
-	// 2) Auto-import legacy domains (publicsuffix; idempotent; no-op after phase-2 drop).
+	// 2) Import legacy domains only during the one-time upgrade window:
-	if err := importZoneDomainsAfterGoose(sqlDB); err != nil {
+	//    version in [202607120002, 202607130001). After phase-2 drop is applied,
+	//    this is skipped on every subsequent startup.
+	if err := maybeImportZoneDomains(sqlDB); err != nil {
 		log.Fatalf("[%s] zone domain import failed: %v\n", dbType(), err)
 	}
 	// 3) Remaining SQL (drop legacy columns / managed_domains, later migrations).
@@ -91,9 +95,18 @@ func Migrate() {
 	log.Printf("[%s] goose migrate success\n", dbType())
 }
 
-// importZoneDomainsAfterGoose 在 SQL 迁移完成后自动导入旧路由/托管域名。
+// maybeImportZoneDomains runs legacy→Zone import only when the DB is still in the
-// 必须使用 publicsuffix 解析注册根域，故不能放在纯 SQL 中；幂等且在旧列删除后为空操作。
+// pre-drop upgrade window. After 202607130001 is applied, this is a no-op and is
-func importZoneDomainsAfterGoose(sqlDB *sql.DB) error {
+// not executed on normal restarts.
+func maybeImportZoneDomains(sqlDB *sql.DB) error {
+	version, err := goose.GetDBVersion(sqlDB)
+	if err != nil {
+		return fmt.Errorf("get goose db version: %w", err)
+	}
+	if version < zoneImportSQLVersion || version >= zoneDropLegacySQLVersion {
+		return nil
+	}
+
 	ctx := context.Background()
 	tx, err := sqlDB.BeginTx(ctx, nil)
 	if err != nil {