ci: fix prod org var name, add ACA FQDN to deployment summary

- Fixed SHARING_ALLOWED_GITHUB_ORGS typo in production env (was plural,
  workflow reads singular SHARING_ALLOWED_GITHUB_ORG)
- Added aca_fqdn to deployment summary table so the production CNAME
  target is visible immediately after first deploy
- Added DNS setup instructions to production summary when custom domain
  is not yet configured

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rajbos

.github/workflows/sharing-server-deploy.yml

@@ -259,6 +259,7 @@ jobs:
         working-directory: sharing-server/infra
         run: |
           APP_URL=$(terraform output -raw app_url)
+          ACA_FQDN=$(terraform output -raw aca_fqdn)
           OAUTH_URL=$(terraform output -raw oauth_callback_url)
           DASH_URL=$(terraform output -raw dashboard_url)
           HEALTH_URL=$(terraform output -raw health_url)
@@ -272,8 +273,19 @@ jobs:
             echo "| Dashboard | ${DASH_URL} |"
             echo "| Health | ${HEALTH_URL} |"
             echo "| OAuth callback | ${OAUTH_URL} |"
+            echo "| ACA FQDN (CNAME target) | ${ACA_FQDN} |"
           } >> "$GITHUB_STEP_SUMMARY"
 
+          if [[ "${{ needs.setup.outputs.is_prod }}" == "true" ]]; then
+            {
+              echo ""
+              echo "> 📋 **Custom domain DNS setup** — if \`SHARING_CUSTOM_DOMAIN\` is not yet set,"
+              echo "> add these records at your DNS provider, then set the variable and redeploy:"
+              echo "> - \`CNAME <subdomain>\` → \`${ACA_FQDN}\`"
+              echo "> - \`TXT asuid.<subdomain>\` → *(ACA environment verification ID from Azure portal)*"
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
           if [[ "${{ needs.setup.outputs.is_prod }}" == "false" ]]; then
             {
               echo ""