feat!: regional-only deployment — drop legacy append-user support

[venkatamutyala]

What

Makes this repo regional-only: the stack deploys per-datacenter tunnel servers for the regional CDE rollout, and legacy support is removed rather than parameterized (an earlier revision of this PR had a SISH_SUBDOMAIN_FLAGS toggle with a legacy default — dropped by decision).

• --force-requested-subdomains is hardcoded: a codespace VM binds its bare hostname, URLs are https://<hostname>.<region>.tunnels.cde.glueopshosted.com (no prefix), and a taken name fails the bind instead of silently going random. The append-user flags are gone.
• .env.example targets a regional deployment: DOMAIN=<region>.tunnels.cde.glueopshosted.com, AWS creds from the acme-dns01-cde.glueopshosted.com IAM user (cde_acme_* outputs of the CDE assets workspace).
• README documents the regional model, the CloudFront relationship (this box is the origin as origin.<region>..., covered by the same wildcard cert; 443 deliberately stays directly reachable), and a smoke test that catches a wrong-version deployment by URL shape.
• MIGRATION.md (old-fork → this stack, central-box content) is removed; it remains in git history and pre-0.4 tags.

The legacy central box (tunnels.glueopshosted.com) is unaffected — it stays on its current pre-0.4 checkout and needs no changes.

Also folded in: Renovate updates + auth hardening

Supersedes the open Renovate PRs (#28, #29, #30): base image → python:3.14-alpine (taking #29 over #28's 3.13) and click==8.4.2. A Python-expert review verified every pin on the exact digest (cp314 musllinux wheels present with MarkupSafe's C speedups active; Flask/Werkzeug CI-test 3.14 upstream; gunicorn 26.0.0 lacks official 3.14 metadata but its sync-worker path is exercised and passing) — Renovate will auto-close those PRs once this merges.

The same review found three live-reproducible defects in the TOFU authorizer, fixed here in auth/auth.py:

• a non-string auth_key crashed mid-registration and left an empty key file, permanently locking that username out — JSON shape/types are now validated up front;
• distinct raw usernames could collapse onto one key file via secure_filename ("vm 1" vs "vm_1") — any username the sanitizer would alter is now rejected outright (VM hostnames always pass unchanged);
• registration had a create-then-write window exposing empty files to concurrent workers — keys are now written to a temp file and hard-linked into place atomically, and a same-key race loser (same VM connecting twice at boot) is still allowed.

Plus: 16 KB request cap, remote_addr in the audit log lines, and PYTHONUNBUFFERED=1 so those lines actually flush. Full flow re-tested in the built image: register/allow/deny, poisoning attempt then legitimate registration, collision rejection, path traversal, no temp/empty leftovers, oversized body → 413.

A second review pass (fresh Python expert + a sish expert working from the tagged v2.23.0 source) confirmed the wire contract exactly (payload shape, comment-free/newline-free key format, per-key deny semantics, TOFU re-checked on every reconnect, adversarial 32-way race tests producing exactly one registration) and added:

• auth.py: usernames capped at the 63-char hostname label limit (oversized attacker-chosen SSH usernames previously reached the filesystem → traceback-spamming 500s from the public SSH port); any OSError reading a stored key now denies instead of 500ing; whitespace-only keys rejected.
• compose: --authentication-key-request-timeout 15s → 3s — sish holds a global lock across the webhook call, so a hung authenticator serialized all auth on the instance; 3s bounds the stall (the webhook answers in ms). --authentication-keys-directory now points at a tmpfs, making sish's webhook-bypass path (any key file in that directory is accepted without consulting the authenticator) empty by construction.
• companion fix in fix: pin sish tunnel auth to the dedicated key with IdentitiesOnly codespaces#551: -o IdentitiesOnly=yes on the autossh invocation — without it, a forwarded ssh-agent's keys are offered first and TOFU can permanently pin the wrong key on a VM's first connection.

Deploying a region

1. .env: regional DOMAIN, cde_acme_* creds, ACME_EMAIL. No naming flag — the stack is regional by construction.
2. docker compose up -d — certbot needs the cde.glueopshosted.com NS delegation live to validate (aws-dns-production#150).
3. Smoke test: ssh -p 2222 -R smoketest:80:localhost:3000 <region>.tunnels.cde.glueopshosted.com → the printed URL must be https://smoketest.<region>... with no <user>- prefix.
4. Continue with the region runbook in feat: regional tunnel endpoints for CDE tunnels and access URLs slackbot-developer-workspaces#499 (DNS/CloudFront via glueops-opentofu-workspaces/aws-cloud-development-environment-assets-production#74).

🤖 Generated with Claude Code