Check apex DNS before promising vanity profile URLs

Before wiring profile links like example.dev/u/name into a CLI or welcome email, resolve the apex with dig and compare against the distributions in your own cloud account: the apex can still point at an old landing host (a CloudFront not in your account) while the new marketing site lives on Vercel. Plan the route where the marketing app renders (e.g. a Next.js /u/[username] page reusing its design system) backed by a public read-only API endpoint that returns only approved content and never emails.