Apps can only be served on a single hostname, so www aliases are unroutable

## Problem

`once deploy --host example.com` registers exactly one hostname with the proxy. Requests for common aliases like `www.example.com` reach the server (e.g. via a CNAME to the apex) but kamal-proxy has no route for them and no TLS certificate, so they fail — even though kamal-proxy itself supports multiple `--host` values per service.

## What I tried

- There's no supported way to pass additional hostnames today: `deployArgs` in `internal/docker/proxy.go` forwards the single `Host` string as one `--host` flag.
- Amusingly, a comma-separated value (`--host "example.com,www.example.com"`) *almost* works, because kamal-proxy's `--host` is a pflag `StringSlice` that splits on commas — but post-deploy verification builds `https:///up` from the raw string, producing an invalid URL, so `VerifyHTTPOrRemove` tears the route back down.
- Workaround that works but doesn't survive updates: re-running `kamal-proxy deploy` inside the proxy container with extra `--host` flags. ONCE re-registers the route from its single-host settings on the next app update, dropping the alias again.

## Proposal

Allow `--host` to be repeated:

```bash
once deploy ghcr.io/me/app:latest --host example.com --host www.example.com
```

- Store hostnames comma-joined in the existing `host` settings field, so serialized settings stay backward compatible with single-host installs.
- Treat the first hostname as canonical for display URLs and HTTP verification.
- Match any hostname in lookups (`once update www.example.com`) and duplicate-host checks.

I have a working implementation with tests (full suite including integration passes) and will open a PR shortly.

Start in internal/docker/proxy.go and trace deployArgs, host lookup and duplicate-host checks, then inspect VerifyHTTPOrRemove for its URL handling. Use the existing tests and full integration suite as the validation path; done means repeated --host values survive updates, aliases route correctly, and verification uses the canonical hostname.

Written by the indexing model from the issue text.