fix(cdn): restore Alliance pull-zone hostname (#166)

## Motivation

Applying #165 recreated the Alliance SwissPass pull zone without its custom hostname because the hostname association was not represented in OpenTofu.
The recreated zone also received a new numeric ID, making the weekly purge configuration stale.

## Changes

- Manage `cran.allianceswisspass.devxy.io` as a pull-zone hostname with TLS and forced HTTPS.
- Resolve the Alliance pull-zone ID from its hostname before purging instead of persisting a replaceable numeric ID.
- Install `jq` in the purge step for the Bunny API lookup.

## Verification

- Targeted `prek` hooks pass.
- `tofu validate` passes.
- `crow lint .crow/` passes.
- `just edge-test` passes all 14 routing steps.
- `bash -n scripts/purge_cdn_zone.sh` passes.

## Deployment

Run `tofu apply` to restore the Alliance hostname on the recreated pull zone.

Reviewed-on: #166

.crow/weekly-rebuild-reindex.yaml

@@ -175,9 +175,9 @@ steps:
         from_secret: BUNNYNET_API_KEY
       # cran.rpkgs.com and cran.allianceswisspass.devxy.io are on separate
       # Bunny pull zones, so both must be purged after the shared origin changes.
-      BUNNY_PULLZONES: '3857050 3265648'
+      BUNNY_PULLZONES: '3857050 cran.allianceswisspass.devxy.io'
     commands:
-      - apk add --no-cache -q bash curl
+      - apk add --no-cache -q bash curl jq
       # Crow carries the checkout from the re-index step into this step.
       - bash scripts/purge_cdn_zone.sh "$BUNNYNET_API_KEY" $BUNNY_PULLZONES
     # Runs on every row rather than on one designated slot: a cron fires only