v2-platform: 08 member subdomains — bindings, per-request composition, wildcard TLS

Parent

#274 (v2 platform services spec)

What to build

Member subdomains: org-eligible members deploy UI-level customizations served at <user>.<city>.<domain>. The binding table gains member entries (resolved through the existing 30s-cached host resolver); the member's runtime extends the city runtime and may override UI and plugin-UI remotes ONLY — enforced server-side, so no unverified member server code ever executes in a host process. This ticket resolves the per-request composition question (wayfinder ticket 06): composed trees cached per member/tenant with invalidation on republish, or the single-tree runtime-override alternative — decided by measurement here. SSR stays per-binding gated. Wildcard TLS via DNS-only wildcard CNAME plus ACME-challenge delegation to the host's auto-issued wildcard certificate (free, any depth — no paid certificate manager). Deploy-time: the deploy service registers the member binding after the eligibility gate passes.

Acceptance criteria

• A member deploy is served at their subdomain of the city node's domain over HTTPS within the resolver cache TTL
• Member configs can override UI/plugin-UI remotes only; attempts to override server-side remotes are rejected
• Per-request composition is correct under three config layers (base, tenant, member) with cached composed trees and invalidation on republish — or the measured decision record shows the single-tree alternative winning
• Member bindings are created only for org-eligible accounts and only through the deploy service
• Wildcard HTTPS works for any member subdomain without per-hostname certificates
• SSR for member subdomains respects the per-binding SSR gate

Blocked by

• #281 (all web plugins grafted — override-by-plugin is the member surface)
• #275 (deploy service core — eligibility + binding registration)

Start with the parent v2 platform services spec in #274, then review the blocked work in #281 and #275 and the existing host resolver, runtime composition, and deploy service entry points. Measure the cached composed-tree and single-tree alternatives, and verify binding eligibility, server-side override restrictions, wildcard TLS, and per-binding SSR against the acceptance criteria.