www: redirect alias hostnames (e.g. apex) to canonical origin

Adds www_redirect_hostnames; renders a www-redirect ingress that 301s
to https://<www_hostname>$request_uri while leaving more specific paths
on the same host (e.g. /.well-known/matrix/*) to their own ingresses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -54,6 +54,7 @@ Defaults deliberately refuse incomplete membership deployments. Configure:
 | --- | --- |
 | `www_namespace` | Namespace, default `www` |
 | `www_hostname` | Canonical HTTPS hostname, default **www.eom.dev** |
+| `www_redirect_hostnames` | Hostnames 301-redirected to `www_hostname`, default `[]` |
 | `www_membership_enabled` | Deploy membership/proxy, default true |
 | `www_membership_image` | Required versioned application image/digest |
 | `www_membership_secret_name` | Existing Secret, default `membership` |
@@ -239,7 +240,10 @@ app defaults to eom.dev. This role sets `MEMBERSHIP_PUBLIC_URL` to
 
 To serve the apex instead, set `www_hostname: eom.dev` and align DNS,
 certificates, callbacks and redirects. Membership requires one canonical HTTPS
-origin for sessions, CSRF, email verification and OIDC.
+origin for sessions, CSRF, email verification and OIDC. To send apex visitors
+to the canonical origin without serving it there, set
+`www_redirect_hostnames: [eom.dev]`; other ingresses' more specific apex paths
+(such as `/.well-known/matrix/*`) keep working.
 
 ## Upgrades and operations