fix(cdn): restore Alliance pull-zone hostname (#166)

## Motivation

Applying #165 recreated the Alliance SwissPass pull zone without its custom hostname because the hostname association was not represented in OpenTofu.
The recreated zone also received a new numeric ID, making the weekly purge configuration stale.

## Changes

- Manage `cran.allianceswisspass.devxy.io` as a pull-zone hostname with TLS and forced HTTPS.
- Resolve the Alliance pull-zone ID from its hostname before purging instead of persisting a replaceable numeric ID.
- Install `jq` in the purge step for the Bunny API lookup.

## Verification

- Targeted `prek` hooks pass.
- `tofu validate` passes.
- `crow lint .crow/` passes.
- `just edge-test` passes all 14 routing steps.
- `bash -n scripts/purge_cdn_zone.sh` passes.

## Deployment

Run `tofu apply` to restore the Alliance hostname on the recreated pull zone.

Reviewed-on: #166

scripts/purge_cdn_zone.sh

@@ -19,22 +19,54 @@
 # why this is not used by the daily update path.
 #
 # The public hostnames currently use separate pull zones, so callers must pass
-# every zone that serves the repository.
+# every zone that serves the repository. A zone can be identified by its
+# numeric ID or by one of its hostnames; hostname lookup avoids persisting IDs
+# that change when a zone is recreated.
 #
 # Usage:
-#   purge_cdn_zone.sh <BUNNYNET_API_KEY> <pull_zone_id> [<pull_zone_id>...]
+#   purge_cdn_zone.sh <BUNNYNET_API_KEY> <pull_zone> [<pull_zone>...]
 #
 set -euo pipefail
 
 if (($# < 2)); then
-  echo "usage: $0 <api_key> <pull_zone_id> [<pull_zone_id>...]" >&2
+  echo "usage: $0 <api_key> <pull_zone> [<pull_zone>...]" >&2
   exit 2
 fi
 
 api_key="$1"
 shift
 
-for zone_id in "$@"; do
+resolve_zone_id() {
+  local zone="$1"
+  local response_file
+  local zone_id
+
+  if [[ "${zone}" =~ ^[0-9]+$ ]]; then
+    echo "${zone}"
+    return
+  fi
+
+  response_file=$(mktemp)
+  curl -sS -o "${response_file}" \
+    -H "AccessKey: ${api_key}" \
+    "https://api.bunny.net/pullzone"
+  zone_id=$(
+    jq -r --arg hostname "${zone}" \
+      '(.Items // .)[] | select(any(.Hostnames[]?; .Value == $hostname)) | .Id' \
+      "${response_file}"
+  )
+  rm -f "${response_file}"
+
+  if [[ -z "${zone_id}" ]]; then
+    echo "Could not find BunnyCDN pull zone for hostname ${zone}" >&2
+    exit 1
+  fi
+
+  echo "${zone_id}"
+}
+
+for zone in "$@"; do
+  zone_id=$(resolve_zone_id "${zone}")
   echo "Purging BunnyCDN pull zone ${zone_id}"
 
   response_file="/tmp/purge_zone_response_${zone_id}.txt"