fix(security): strictly compare DNS TXT record in domain verification

Previously used txt.includes(record.txtRecord), which would accept any
TXT record that contained the verification string as a substring. Switch
to strict equality so domain verification cannot be spoofed by embedding
the token inside another record.

Refs #10

Author: dobby-coder[bot]

src/lib/server/services/dns-verification.ts

@@ -40,7 +40,7 @@ export async function verifyDns(orgId: string): Promise<{
 	try {
 		const txtRecords = await resolve(record.domain, 'TXT');
 		const flat = txtRecords.flat();
-		const found = flat.some((txt) => txt.includes(record.txtRecord));
+		const found = flat.some((txt) => txt === record.txtRecord);
 
 		if (found) {
 			await db