fix(identity): skip DKIM keygen on a domain reclaim

[AmirF194]

Summary

claimOrCreateDomain generated a fresh RSA-2048 DKIM keypair (plus the AEAD
seal over its private key, #144) before checking whether the domain row
already existed. On a reclaim, the common idempotent path the function's own
docstring describes ("the DKIM keypair are minted on first INSERT and remain
stable across re-claims"), the SELECT branch returns the existing row and the
freshly generated keypair is discarded, unused. Every re-register of an
already-owned domain paid for a full RSA-2048 keygen for nothing.

The fix moves the keygen/seal block into the pgx.ErrNoRows branch, right
before the INSERT that is its only consumer, so it runs once per domain
instead of once per call. Stored data is byte-for-byte identical either way;
this only removes the wasted work.

Operational risk

None. No stored data changes, no API response changes. The keygen/seal now
runs while holding the per-domain advisory lock (previously it ran before the
transaction started), which only extends lock hold time on the once-per-domain
new-row path; the existing TestClaimOrCreateDomain_ConcurrentParentChildClaimsDoNotSplitOwnership
and TestClaimOrCreateDomain_HierarchicalClaimsAreExclusiveAcrossAccounts
tests still pass unmodified.

Test plan

• New regression test TestClaimOrCreateDomain_ReclaimSkipsDKIMKeygen
  (internal/identity/store_test.go): swaps crypto/rand.Reader for a
  byte-counter around a reclaim call only. Fails on unmodified main
  (120977 bytes read, a real RSA-2048 keygen) and passes on the branch
  (well under the 256-byte threshold, which is comfortably above
  generateID's own unrelated 16-byte read on every call).
• go vet ./internal/identity/... and gofmt -l on both changed files:
  clean.
• Full go test ./internal/identity/... ./internal/dkim/...: all
  passing (505s/1s), including the pre-existing
  TestClaimOrCreateDomain_StableOnReclaim (DKIM key/verification token
  stability across reclaim, unaffected) and the two concurrency tests named
  above.
• Docker, Go 1.26 (matching CI's go-version: "1.26") against a
  postgres:16-alpine service on :5433 with the CI's own credentials, the
  same shape go-coverage/go-e2e use.
• Not run: make test-e2e (the separately tagged integration suite) and the
  web/TS/Python/CLI/MCP jobs, none of which touch this file.

Fixes #826

[AmirF194]

Thanks for merging!