Free per-user homepages at <name>.<host> (wildcard subdomains)

- sites.AskHandler now approves <name>.AGENTBBS_HOST on-demand-TLS when <name>
  is a registered member (so only real users mint subdomain certs).
- Caddyfile: *.${DOMAIN} block serving users/<name>/public_html with on_demand
  TLS; unknown users 404. Needs a wildcard DNS record *.${DOMAIN} -> host.
- Test: TestAskUserSubdomain.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -381,6 +381,7 @@ fi
 # Let Caddy (user 'caddy') read the per-user public_html trees.
 usermod -aG "$SVC_USER" caddy 2>/dev/null || true
 log "writing Caddyfile"
+DOMAIN_RE=$(printf '%s' "$DOMAIN" | sed 's/[.]/\\./g')   # dots escaped for Caddy host_regexp
 cat > /etc/caddy/Caddyfile <<CADDY
 {
 	email ${ACME_EMAIL}
@@ -417,6 +418,26 @@ ${DOMAIN} {
 	}
 }
 
+# Free per-user homepages at <name>.${DOMAIN} (needs wildcard DNS
+# *.${DOMAIN} -> this host). On-demand TLS mints a cert only when agentbbs's
+# ask endpoint confirms <name> is a registered member, so random subdomains
+# can't trigger certificate issuance.
+*.${DOMAIN} {
+	encode zstd gzip
+	tls {
+		on_demand
+	}
+	@user host_regexp user ^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.${DOMAIN_RE}\$
+	handle @user {
+		root * ${DATA_DIR}/users/{re.user.1}/public_html
+		try_files {path} {path}/index.html
+		file_server browse
+	}
+	handle {
+		respond "no such user" 404
+	}
+}
+
 # Custom domains a member pointed at this host (ssh domain@${DOMAIN} add ...).
 # The symlink farm in domains/ maps each host to its owner's public_html, so
 # {host} resolves to the right tree; unmapped hosts 404 (and never got a cert).