Free per-user homepages at <name>.<host> (wildcard subdomains)

- sites.AskHandler now approves <name>.AGENTBBS_HOST on-demand-TLS when <name>
  is a registered member (so only real users mint subdomain certs).
- Caddyfile: *.${DOMAIN} block serving users/<name>/public_html with on_demand
  TLS; unknown users 404. Needs a wildcard DNS record *.${DOMAIN} -> host.
- Test: TestAskUserSubdomain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/sites/sites_test.go

@@ -110,3 +110,39 @@ func TestManagerAddRemoveSyncAsk(t *testing.T) {
 		t.Error("expected domain unmapped in store")
 	}
 }
+
+func TestAskUserSubdomain(t *testing.T) {
+	t.Setenv("AGENTBBS_HOST", "bbs.profullstack.com")
+	dir := t.TempDir()
+	st, err := store.Open(filepath.Join(dir, "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if _, err := st.EnsureUser("alice", "member", "SHA256:aaa"); err != nil {
+		t.Fatal(err)
+	}
+
+	m, err := NewManager(st, dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	h := m.AskHandler()
+
+	for _, c := range []struct {
+		domain string
+		code   int
+	}{
+		{"alice.bbs.profullstack.com", http.StatusOK},        // registered member → cert allowed
+		{"nobody.bbs.profullstack.com", http.StatusNotFound}, // no such user
+		{"a.b.bbs.profullstack.com", http.StatusNotFound},    // multi-label, not a user subdomain
+		{"bbs.profullstack.com", http.StatusNotFound},        // apex is not a user subdomain
+	} {
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/check?domain="+c.domain, nil)
+		h.ServeHTTP(rec, req)
+		if rec.Code != c.code {
+			t.Errorf("ask %q = %d, want %d", c.domain, rec.Code, c.code)
+		}
+	}
+}