Check public deployment HTTPS

Requires read scope and an owned deployment with a saved public hostname. No request body or arbitrary URL. Returns deployment-network-probe-v1 with dns, tls, http, http_status, code, generated_at and not_checked. HEAD to HTTPS port 443, verified TLS, pinned public DNS address, no redirects, proxies, credentials, response headers or body. Eight-second connection timeout; system DNS uses the resolver timeout. One request per account every 30 seconds; unavailable limit storage fails closed.