feat(config): reject over-broad Origin allowlist entries (#23)

[JumpTechCode]

What

Validate allowed_origins at the fail-fast config gate and reject entries that defeat the edge's DNS-rebinding guard (design §8, issue #23).

The guard (internal/edge/guard.go) is a pure prefix/exact matcher — it faithfully honors whatever it is given and cannot judge whether an entry is too broad. That judgement belongs in the validation layer, where the gateway already rejects bad configuration before request time (§7). This keeps the guard a pure matcher.

Config.Validate now rejects, with an actionable message:

• a bare "*" (empty prefix → matches every Origin, allow-all);
• a wildcard not preceded by a scheme delimiter ("localhost*", "://*");
• a wildcard over the whole host of a network scheme ("http://*", "https://*", "ws://*", "wss://*"). Opaque schemes keep the scheme itself as the boundary ("vscode-webview://*", "app://*") and still load;
• an exact entry that is not a bare origin — no scheme, or carrying a path/query/fragment (a real Origin header carries none, so such an entry is dead config that never matches).

The check is part of Validate(), so it guards both initial load (config.Load) and SIGHUP reload (app.go).

Acceptance criteria (issue #23)

• Config load rejects an over-broad Origin allowlist entry with a clear, actionable error message.
• Tests cover the rejected forms and confirm legitimate entries (http://localhost, vscode-webview://*) still load.

Testing

• New table cases in TestValidateRejects for every rejected form; new TestValidateAcceptsLegitimateOrigins for the allowed forms.
• make verify locally: build, vet, -race tests, coverage 95.3% (gate 80%), golangci-lint v2.12.2 clean, gofmt clean.
• The shipped example config (config/portcullis.example.yaml) still validates (existing app test).

Closes #23

🤖 Generated with Claude Code