fix(certstream): correct URL to calidog.io (typo in M3 spec: calidus→calidog)

The task spec had 'wss://certstream.calidus.io/' — that domain does not
exist (NXDOMAIN). The canonical public CertStream is at
'wss://certstream.calidog.io/'. Made it env-overridable.

Also: certstream logs showed 60 brands loaded (55 in JSON + a few
dups from cleaning). Container now resolves calidog.io correctly.

app/domain/threat/certstream_listener.py

@@ -174,7 +174,10 @@ async def _persist_domain(domain: str, brand: str, issued_at: datetime | None, i
 
 
 # ── CertStream WebSocket listener ──────────────────────────────────
-CERTSTREAM_URL = "wss://certstream.calidus.io/"
+# Public CertStream (CaliDog) — the canonical free CT feed.
+CERTSTREAM_URL = os.getenv(
+    "CERTSTREAM_URL", "wss://certstream.calidog.io/"
+)
 
 
 async def _process_message(msg: dict) -> int: