Consolidate to one domain, replace placeholder URLs, load real secrets

[ianpatrickhines]

Context

Endpoint configuration is inconsistent and not yet pointed at real infrastructure, so nothing actually connects end-to-end. Three different domains appear across the codebase:

• Extension → https://streaming.nat.example.com, https://nat.example.com/... (placeholders), support@nat.example.com
• Site → https://api.natassistant.com/stripe/checkout and /stripe/verify-session (hardcoded fallback)
• Privacy/terms links → asknat.ai

Also: Lambda env-var defaults don't match the template (e.g. handler default nat/anthropic-api-key vs template nat/anthropic-api-key-${Environment}), risking a prod Lambda reading a dev/wrong secret; and API Gateway has no custom domain (custom-domain param is commented out in infrastructure/template.yaml).

Acceptance Criteria

• Pick ONE canonical domain and use it consistently across extension, site, and legal links
• Replace all example.com placeholders with real, build-time-injected URLs (VITE_CHECKOUT_API_URL, VITE_VERIFY_API_URL, extension streaming/auth URLs)
• Reconcile Lambda env-var defaults with the CloudFormation template (no silent fallback to a wrong secret path)
• Populate required secrets in Secrets Manager for the target env (Anthropic key, NB OAuth client id/secret, Stripe secret + webhook secret)
• Wire up a custom domain for the API Gateway (ACM cert + DNS) — or explicitly defer with a note
• End-to-end smoke: extension → backend → NB returns a real result in the target env

[ianpatrickhines]

Blocked on a decision (not ready for pr-driver): the canonical domain hasn't been chosen yet (candidates: asknat.ai, natassistant.com, or a fresh one). Removed status:ready until Ian picks. Phase 1–2 work does not depend on this.

[ianpatrickhines]

Add to the secrets-to-provision list: nat/session-jwt-secret-{env} — the HS256 signing secret for the session-token auth (#10). Wired into 3 Lambdas via SESSION_JWT_SECRET_NAME, IAM already allows secretsmanager:GetSecretValue on nat/*, but no secret resource is created (same out-of-band convention as the anthropic/nb/stripe secrets). Without it, every authenticated request + the OAuth callback 500s. Must be created before/with the deploy that ships #10.

[ianpatrickhines]

Deploy-packaging gap (from #11): deploy.yml must (1) package the new nb_oauth_init Lambda, and (2) bundle src/lambdas/shared into BOTH nb_oauth_callback and nb_oauth_init zips (they import shared.session_token/oauth_state since #10/#11; current cd dir; zip . step omits shared). Mirror the nat_agent packaging pattern. Without this both OAuth Lambdas ImportError at runtime on first deploy.