[management] Allow concurrent service domain authorization

Service writes only need shared locks on registrations covering their hostname. Hold those locks until commit to preserve the deletion guard while allowing concurrent writes on the same or unrelated domains.

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -362,7 +362,11 @@ func (m Manager) ValidateServiceDomain(ctx context.Context, tx nbstore.Store, ac
 	if _, ok := ExtractClusterFromFreeDomain(serviceDomain, []string{cluster}); ok {
 		return nil
 	}
-	customDomains, err := tx.LockCustomDomains(ctx, accountID)
+	name, err := nbdomain.FromString(serviceDomain)
+	if err != nil {
+		return fmt.Errorf("parse service domain: %w", err)
+	}
+	customDomains, err := tx.LockCustomDomains(ctx, accountID, name)
 	if err != nil {
 		return err
 	}