fix(cdn): restore Alliance pull-zone hostname (#166)

## Motivation

Applying #165 recreated the Alliance SwissPass pull zone without its custom hostname because the hostname association was not represented in OpenTofu.
The recreated zone also received a new numeric ID, making the weekly purge configuration stale.

## Changes

- Manage `cran.allianceswisspass.devxy.io` as a pull-zone hostname with TLS and forced HTTPS.
- Resolve the Alliance pull-zone ID from its hostname before purging instead of persisting a replaceable numeric ID.
- Install `jq` in the purge step for the Bunny API lookup.

## Verification

- Targeted `prek` hooks pass.
- `tofu validate` passes.
- `crow lint .crow/` passes.
- `just edge-test` passes all 14 routing steps.
- `bash -n scripts/purge_cdn_zone.sh` passes.

## Deployment

Run `tofu apply` to restore the Alliance hostname on the recreated pull zone.

Reviewed-on: #166

cdn.tf

@@ -199,6 +199,13 @@ resource "bunnynet_pullzone" "cran_allianceswisspass" {
   block_root_path = true
 }
 
+resource "bunnynet_pullzone_hostname" "cran_allianceswisspass" {
+  pullzone    = bunnynet_pullzone.cran_allianceswisspass.id
+  name        = "cran.allianceswisspass.devxy.io"
+  force_ssl   = true
+  tls_enabled = true
+}
+
 # resource "bunnynet_storage_zone" "devxy-r-binaries" {
 #   name      = "devxy-r-binaries-storage"
 #   region    = "DE"