An app gets its own domain #326

An app can answer at a name its owner holds — game.example.com, or an apex — beside the hostname the forge gave it.

• Settings → App → Domains: add a host, publish two records (TXT _forge-verify.<host> = forge-verify=<token> proves the name; a CNAME to the app's host carries traffic — an apex uses ALIAS/A), press Check now. Verified once, the forge serves production there; production's URL, FORGE_APP_URL and every Open-the-app link follow. Verification is sticky; removing the domain is what unserves it.
• Proxy: an unverified name is never served; a private app's grant works on the new host.
• API: GET/POST /api/v1/repos/:o/:n/app/domains, POST …/:host/check, DELETE …/:host; domains on the app JSON.
• GET /__forge/domains/ask?domain= for Caddy on-demand TLS when the forge is self-hosted (docs/EXTRACT.md).
• Security fix found by review, predating this branch: /apps/open?host=evil#x--notes… sent a signed grant to a stranger's origin. A host is now a hostname and at most a port before it is read as anything.

Full suite 1934/0 locally; docs/APPS.md "Your own domain".