docs(core): explain DomainKit and Domain Connect (#71)

## Summary

Add a Concepts page explaining how DomainKit and Domain Connect overlap,
where Domain Connect is the better fit, and why provider participation
and template onboarding can make an API-native lifecycle more practical.

## Comparison

| | Domain Connect | DomainKit |
| --- | --- | --- |
| Primary unit | Provider-supported service template | Provider
connection and DNS lifecycle |
| Write path | Provider applies the template | Host calls a provider
adapter |
| State | Protocol/provider flow state | Plans, digests, attachments,
receipts, observations |
| Credential boundary | Provider-owned authorization | Host-owned
custody, consent, and persistence |

## Changes

- Add `/docs/core/domain-connect` with fit guidance, provider-onboarding
constraints, security tradeoffs, and coexistence boundaries.
- Link the explanation from the Concepts navigation, connections guide,
and docs landing page.

## Validation

- `bun run build` in `packages/domainkit`
- `bun run build` in `apps/docs`
- `bun run reference:check`
- `./node_modules/.bin/blume validate --strict`
- `bun run audit --strict`
- `bun run typecheck`
- Rendered `/docs/core/domain-connect` locally and verified navigation
and links.