refactor: update according to code review

backend/src/migrations/002_domains.sql

@@ -14,4 +14,5 @@ CREATE TABLE IF NOT EXISTS domains (
   FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE SET NULL
 );
 
-CREATE INDEX IF NOT EXISTS idx_domains_hostname ON domains(hostname);
+-- Enforce at most one default domain at the database level
+CREATE UNIQUE INDEX IF NOT EXISTS idx_domains_single_default ON domains(is_default) WHERE is_default = 1;

backend/src/routes/domains.ts

@@ -7,6 +7,7 @@ import { logActivity } from '../middleware/activityLogger';
 import { logger } from '../utils/logger';
 
 const router = Router();
+const domainService = new DomainService();
 
 // ===================================
 // GET ALL DOMAINS
@@ -17,7 +18,6 @@ router.get(
   requirePermission('settings.read'),
   async (req: Request, res: Response) => {
     try {
-      const domainService = new DomainService();
       const domains = domainService.getAllDomains();
       res.json(domains);
     } catch (error) {
@@ -53,7 +53,6 @@ router.post(
         });
       }
 
-      const domainService = new DomainService();
       const domain = domainService.addDomain(validation.data.hostname, req.user!.id);
       res.status(201).json(domain);
     } catch (error) {
@@ -93,7 +92,6 @@ router.delete(
         });
       }
 
-      const domainService = new DomainService();
       const deleted = domainService.deleteDomain(id);
 
       if (!deleted) {
@@ -129,7 +127,6 @@ router.patch(
         });
       }
 
-      const domainService = new DomainService();
       const domain = domainService.setDefault(id);
 
       if (!domain) {

backend/src/routes/system-settings.ts

@@ -11,6 +11,7 @@ import { logger } from '../utils/logger';
 
 const router = Router();
 const systemSettings = new CachedSystemSettingsService();
+const domainService = new DomainService();
 
 // Helper function to update job scheduler when jobs settings change
 function updateJobScheduler(category: string, settings: Record<string, any>): void {
@@ -73,7 +74,6 @@ router.get('/public', async (req: Request, res: Response) => {
 
     // Inject default domain from domains table
     try {
-      const domainService = new DomainService();
       (publicSettings as any).domains = {
         defaultDomain: domainService.getDefaultDomain(),
       };

backend/src/server.ts

@@ -39,6 +39,9 @@ async function startServer() {
     })
   );
 
+  // Single DomainService instance — reused by CORS and routes
+  const domainService = new DomainService();
+
   // CORS - dynamic origin to support configured domains
   app.use(
     cors({
@@ -51,7 +54,6 @@ async function startServer() {
 
         // Check domains from the database
         try {
-          const domainService = new DomainService();
           const allowed = domainService.getAllowedOrigins();
           if (allowed.has(origin)) return callback(null, true);
         } catch {