[AI Gateway] Document Access user metadata

[kennyj42]

Summary

• Add AI Gateway custom domains documentation focused on Access-protected hostnames and provider-relative routing.
• Add dashboard and API configuration examples for custom domains, including the required DNS CNAME step.
• Document reserved cf.* metadata and automatic cf.user_id injection for Access-authenticated custom domain requests.
• Add an AI Gateway changelog entry for identity-aware controls.

Source context

• cloudflare/aig/aig-worker-config-api!641: custom-domain config plane CRUD and SSL-for-SaaS provisioning.
• cloudflare/aig/ai-gateway-infra!486: custom-domain data plane and Access JWT auth.
• cloudflare/aig/ai-gateway-infra!681: inject Access JWT sub as cf.user_id metadata.
• cloudflare/aig/ai-gateway-infra!716: release bundle expected to ship this work.

Validation

• pnpm exec prettier --write
• pnpm exec prettier --check src/content/docs/ai-gateway/configuration/custom-domains.mdx
• git diff --check
• pnpm run check currently fails on generated skills/turnstile-spin Worker types (ExportedHandler / Fetcher) unrelated to this PR. No MDX/frontmatter errors were reported before that failure.

[samscott89]

(a) This isn't a limitation, this is a feature! You get to skip account Id/gateway ID
(b) It's not that these are provider-relative, you can use the compat APIs with this approach too

One current limitation though is that it doesn't (yet) work with the newer Rest API endpoints.

[kennyj42]

Addressed in the latest push: reframed the shorter custom-domain path as a feature, called out compat routes explicitly, and replaced that limitation with the current limitation that newer REST API endpoints are not supported yet.

[eeryngloriani-sudo]

Skip me to all restricted connection approved direct

[ethulia]

Suggested change

	The custom domains API is not yet included in the public API reference while the contract is still being finalized.
	The custom domains API is not yet included in the public API and is coming soon.

[kennyj42]

Updated this note in the latest push. I kept the same meaning but used 'will be added after the contract is finalized' to avoid the docs style warning around 'coming soon'.