www: redirect alias hostnames (e.g. apex) to canonical origin

Adds www_redirect_hostnames; renders a www-redirect ingress that 301s
to https://<www_hostname>$request_uri while leaving more specific paths
on the same host (e.g. /.well-known/matrix/*) to their own ingresses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

templates/website.yml.j2

@@ -171,3 +171,39 @@ spec:
   tls:
     - hosts: [{{ www_hostname }}]
       secretName: www
+{% if www_redirect_hostnames | length > 0 %}
+---
+# Send browsers on alias hostnames (e.g. the apex, whose /.well-known/matrix/*
+# paths are owned by another ingress) to the canonical origin. Exact/longer
+# paths on the same host in other ingresses still take precedence over "/".
+# A snippet is used because the controller's annotation validation rejects
+# "$request_uri" in permanent-redirect.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: www-redirect
+  namespace: {{ www_namespace }}
+  annotations:
+    cert-manager.io/cluster-issuer: {{ www_cluster_issuer | to_json }}
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-access-log: "false"
+    nginx.ingress.kubernetes.io/configuration-snippet: {{ ("return 301 https://" ~ www_hostname ~ "$request_uri;") | to_json }}
+spec:
+  ingressClassName: {{ www_ingress_class }}
+  rules:
+{% for host in www_redirect_hostnames %}
+    - host: {{ host }}
+      http:
+        paths:
+          - pathType: Prefix
+            path: /
+            backend:
+              service:
+                name: httpd
+                port:
+                  number: 80
+{% endfor %}
+  tls:
+    - hosts: {{ www_redirect_hostnames | to_json }}
+      secretName: www-redirect
+{% endif %}