Start the Domain Connect one-click flow

Browser entry point for the tier-2 Domain Connect flow: compiles the session's records into a published template, discovers the owning zone's DNS provider, confirms the provider has onboarded that template, and redirects the end user to the provider's own consent/apply page. A redirect back is never treated as proof of success — the callback re-verifies against authoritative DNS. Navigate to it — do not fetch it from script. One-click is a paid-plan feature: a session created by a Free team was created without it, and this route answers 403 forbidden for it (the hosted page never shows that session a one-click button).