www: redirect alias hostnames (e.g. apex) to canonical origin

Adds www_redirect_hostnames; renders a www-redirect ingress that 301s
to https://<www_hostname>$request_uri while leaving more specific paths
on the same host (e.g. /.well-known/matrix/*) to their own ingresses.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validate_manifests.py

@@ -92,6 +92,9 @@ ingress = find(all_objects, "Ingress", "www")
 assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/enable-access-log"] == "false"
 assert ingress["metadata"]["annotations"]["nginx.ingress.kubernetes.io/proxy-body-size"] == "2m"
 assert ingress["spec"]["rules"][0]["http"]["paths"][0]["backend"]["service"]["name"] == "httpd"
+redirect = find(all_objects, "Ingress", "www-redirect")
+assert redirect["spec"]["rules"][0]["host"] == "apex.example.com"
+assert redirect["metadata"]["annotations"]["nginx.ingress.kubernetes.io/configuration-snippet"] == "return 301 " + config["MEMBERSHIP_PUBLIC_URL"] + "$request_uri;"
 for obj in docs("external-membership-workloads"):
     if obj["kind"] == "Deployment":
         pod_checks(obj["spec"]["template"]["spec"], external=True)