fix(router): route appsync-realtime-api and cloudfront.net, and DRY the wildcard-domain list

[Neaox]

Follow-up to #345. Three more gaps in host-based addressing, found by putting every addressing form against every recognised base in one grid rather than testing them one at a time.

Form	localhost	.overcast.sh	.localstack.cloud	.floci.io	amazonaws.com
S3 bare {bucket}.{base}	s3	s3	s3	was ✗	✗ (correct — not an AWS form)
S3 labelled {bucket}.s3.{region}.{base}	s3	s3	s3	s3	s3
{id}.execute-api.{region}.{base}	svc	svc	svc	svc	svc
{id}.lambda-url.{region}.{base}	svc	svc	svc	svc	svc
{id}.appsync-api.{region}.{base}	svc	svc	svc	svc	svc
{id}.appsync-realtime-api.{region}.{base}	was ✗ s3	was ✗ s3	was ✗ s3	was ✗	was ✗
{distributionId}.cloudfront.net	—	—	—	—	was ✗

What was wrong

appsync-realtime-api was claimed as an S3 bucket. Not merely unrouted — the label was unregistered, so the bare virtual-hosted form matched and produced a bucket named {apiId}.appsync-realtime-api.{region}. A subscription to the hostname AWS actually serves landed on the S3 handler.

That matters more than "advertise a safe value for dns.REALTIME" allowed for, which is what #345 did: Amplify and the AppSync SDK derive the realtime host by substituting appsync-api → appsync-realtime-api into the GraphQL URL and never read dns.REALTIME. So the hostname has to route regardless of what the API returns. It now reaches the same endpoint appsync-api serves, with the query string preserved because AppSync carries connection auth there (?header=…&payload=…).

{distributionId}.cloudfront.net was unrouted. It needs no new grammar — the segments are {id}.cloudfront.{base}, so registering cloudfront is enough; CloudFront is global and ParseHostRoute already treats the region as optional. Distribution.DomainName is now minted on the caller's hostname rather than the literal cloudfront.net, which Overcast cannot serve without a DNS override. The staging-distribution lookup takes the ID from the first label instead of trimming a fixed suffix, so it holds for both forms.

localhost.floci.io was missing from the S3 bare-form bases while internal/containerendpoint already advertised it, so a bucket was unreachable on a domain Overcast tells users resolves to it. The two lists were maintained separately and drifted. Both now derive from config.WildcardDNSDomains, and TestVirtualHostBases_coverEveryWildcardDomain fails if they diverge again.

Guardrail change

cloudfront is the first single-word label. The rule that labels must not be plausible bucket-name segments previously required a hyphen; it now accepts a single word only with a written rationale in nonHyphenatedLabelRationale, which keeps the exception visible in review. Generic words (logs, data, cache) still cannot be added.

Documentation

docs/networking.md gains an inventory of every known AWS resource subdomain and whether Overcast routes it, including the ones deliberately absent. AWS publishes no such list — the SDK endpoint rulesets and Smithy's endpointPrefix cover control-plane endpoints only and carry none of execute-api, lambda-url or appsync-api — so it has to be maintained here.

Engine data-plane endpoints (rds, cache, kafka, es, the Cognito hosted UI's auth) are deliberately not routed: Overcast emulates those control planes, so there is nothing behind the hostname, and every one of those labels is a bare common word that would make names like my.cache unaddressable for no benefit.

Separately, OVERCAST_HOSTNAME guidance was inconsistent and in one place pointed the wrong way — cdk.md's worked example set it to localhost.localstack.cloud, so the canonical CDK-on-Windows fix recommended another project's domain. localhost.overcast.sh is now the recommendation across networking.md, cdk.md, the env-var table and the S3 service doc. localhost.localstack.cloud and localhost.floci.io stay recognised and documented so carried-over setups keep working. Where the wildcard domains do not work — offline, and behind DNS rebinding protection — stays surfaced at each site, with the fallbacks named.

Verification

gofmt, go build -tags slim ./..., go vet -tags slim ./..., full ./internal/... and ./tests/integration/..., make lint-go (golangci-lint v2.8.0), and docs-index --check all clean. The 43-cell matrix in TestHostClassifier_everyFormOnEveryBase passes; it was red on the two real gaps before the fix.