A plugin's proxy_domains_requested is fixed at publish time, so it could never
name a destination only the installing server knows: a self-hosted game panel,
a private API. That made a whole category of plugin unbuildable, since no static
manifest can list a domain that differs for every customer.

ctx.http.allow_host(host) lets a server admin authorize one address at setup
time. The platform verifies the caller holds Manage Server and that the host
resolves to a public address, then authorizes it for that server alone. Hosts
are matched exactly, so approving example.de does not authorize panel.example.de.

This writes to the same per-install list ctx.ws.allow_host already used, so a
host approved either way now works for both transports. Each transport still
needs its own capability, and allow_host is gated on proxy:http so an HTTP-only
plugin no longer has to request proxy:websocket just to name an address.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>