docs: document custom domain verification files (#1449)

Describe how to host third-party domain ownership verification files
on an active Logto custom domain, including path rules and limits.

Author: wangsijie

docs/logto-cloud/custom-domain.mdx

@@ -18,6 +18,7 @@ Your custom domains are used for several functions:
 - Callback URIs for [social connectors](/connectors/social-connectors) or [enterprise SSO connectors](/connectors/enterprise-connectors).
 - [Passkey](/end-user-flows/mfa/webauthn) and [passkey sign-in](/end-user-flows/sign-up-and-sign-in/passkey-sign-in) related URLs (Changing the domain after users have linked Passkeys may block both MFA and sign-in with those credentials).
 - [SDK endpoint](/integrate-logto/application-data-structure#openid-provider-configuration-endpoint) for integrating Logto with your application.
+- Domain ownership verification files for third-party platforms (for example WeChat, Apple, or other services that require a static file on your domain).
 
 ## Multiple custom domains \{#multiple-custom-domains}
 
@@ -57,6 +58,34 @@ To add a new custom domain in the Logto Console, follow these steps:
 
 To add multiple custom domains, simply repeat the above steps for each domain you want to configure.
 
+## Domain verification files \{#domain-verification-files}
+
+Some third-party platforms require you to host a small text or JSON file on your domain to prove ownership before you can use their OAuth, SSO, or other integrations. Because a Logto custom domain points to Logto Cloud, you cannot upload that file to your own origin. Logto can host those files for you.
+
+After a custom domain is **Active**, open the domain card in <CloudLink to="/tenant-settings/domains">Console > Settings > Domains</CloudLink> and use the **Domain verification files** section to add, update, or remove files.
+
+**Supported paths**
+
+- Root-level filenames with an extension, such as `/MP_verify_xxx.txt` or `/apple-developer-domain-association.txt`
+- Paths under `/.well-known/`, such as `/.well-known/apple-developer-domain-association.txt`
+
+Only letters, numbers, dots, hyphens, and underscores are allowed in path segments. Nested paths outside `/.well-known/` are not supported.
+
+**Limits**
+
+- Up to **10** verification files per custom domain
+- Content size up to **16,384** characters per file
+- Content type: plain text (`text/plain`) or JSON (`application/json`)
+
+Once saved, Logto serves an exact match for `GET` and `HEAD` requests on the custom domain, for example:
+
+```
+https://auth.example.com/MP_verify_xxx.txt
+https://auth.example.com/.well-known/apple-developer-domain-association.txt
+```
+
+Existing Logto routes always take precedence. Verification files are only served when no other Logto handler matches the path.
+
 ## Troubleshooting \{#troubleshooting}
 
 <details>