feat: support wildcard subdomain matching in trusted_domains

[dono-zz]

Summary

• Add wildcard pattern support (e.g. https://*.example.com) for trusted_domains config and site URLs
• The wildcard * matches exactly one subdomain level — *.example.com matches sub.example.com but not example.com or a.b.example.com
• Scheme must match (https://*.example.com won't match http://sub.example.com)
• Fully backward compatible — exact domain matching is preserved, no config changes needed for existing setups

Motivation

When domains are frequently blocked (e.g. by regional firewalls), operators need to quickly spin up new subdomains. Currently every new subdomain must be manually added to trusted_domains or site URLs. With wildcard support, https://*.example.com covers all future subdomains automatically.

Changes

• server/middleware/cors.go: Modified CheckOriginTrusted() to check wildcard patterns alongside exact matches. Added matchWildcardOrigin() helper function.
• server/middleware/cors_test.go: Added 15 test cases covering matching, non-matching, edge cases, and scheme validation.

Usage

trusted_domains:
  - https://*.example.com    # matches any single-level subdomain
  - https://exact.other.com  # exact match still works

Or via site URLs in the Dashboard — add https://*.example.com as a site URL.

Test plan

• Unit tests pass (go test ./server/middleware/ -run TestMatchWildcard)
• Tested against production Artalk v2.9.1 with live data (read-only volume mount)
• Verified wildcard CORS headers returned correctly for matching subdomains
• Verified non-matching origins (bare domain, nested subdomain, different scheme, unrelated domain) are correctly rejected
• Verified existing exact-match domains continue to work

Idea and used by https://lk21.mobile