[clbotdev]

Closes #82.

What

A team can add redirect domains: hosts that serve nothing and 301-redirect every request to the website's canonical host. This keeps links to an old address working after a move, e.g. docs.medialit.cloud → medialit.cloud/docs.

• Path prefix: put in front of every path. With /docs, docs.example.com/cli?x=1 → example.com/docs/cli?x=1, and / → /docs.
• Per-path rules: exact old paths (trailing slash ignored) sent elsewhere first, e.g. /api/uploadMedia → /docs/api/upload-media. The request query is kept unless the rule has its own. Rules are stored on the redirect domain, not in site.json, so teams that build pages in the builder can use them too.
• Verification: each host has its own TXT _frontlit-verify.<host> token plus the usual CNAME/A routing record, so it can live in any zone. It only redirects once both pass. TLS certificates come from the existing /public/tls-ask gate, which now approves verified redirect domains.
• A hostname is either a custom or a redirect domain, never both, and belongs to one team.

Where

• API: new redirect_domains table (migration 0013), POST /domain/redirect-domains, PATCH/DELETE /domain/redirect-domains/:hostname, POST /domain/redirect-domains/:hostname/verify. GET /domain lists them. resolve-host returns redirectTo { pathPrefix, rules } for a redirect domain.
• MCP: add_redirect_domain, update_redirect_domain, verify_redirect_domain, remove_redirect_domain (add and remove are high impact).
• Sites: decideHost builds the target path from redirectTo.
• Admin: a "Redirect domains" card on Website → Domain, with DNS records, a prefix field and a "Renamed paths" textarea (one /old /new per line).
• docs/architecture.md §12.1/§12.2 and the REST/MCP matrix are updated.

Testing

• Unit tests: domain queries (verification gating, rule updates, removal, cross-team and custom/redirect conflicts), contract validation (prefix, rules, duplicates), and sites decideHost (prefix, rules, query handling, root path).
• Suites: full API suite plus sites (67) and web (97) tests.
• Browser smoke on local servers:
  • Added a redirect domain in the admin UI; a pending domain returns 404.
  • "Check DNS" marks failing records as unsatisfied.
  • Bad rule lines, duplicate old paths and a bad prefix show inline errors.
  • With the domain marked verified, curl and the browser followed 301s for prefix paths, rules and /.
  • With the revalidation webhook configured, rule edits and removal took effect within a second.
  • The TLS ask returns 200 for the verified host and 404 for unknown hosts.
• Not tested: real DNS verification against a live domain. The DNS-to-verified step is unit-tested with mocked DNS.