Support wildcard subdomain keys for mapped TCP egress

[ShravanSunder]

Summary

Adds leading-label wildcard support for tcp.hosts mapping keys, so callers can express dynamic subdomain fleets such as *.discord.gg:443 without enumerating every regional host.

The change keeps mapped TCP narrow:

• wildcard support is key-side only
• mapping values remain exact UPSTREAM_HOST:UPSTREAM_PORT
• global * TCP mappings remain rejected
• mid-label wildcard forms such as api.*.example.com remain rejected
• *.example.com does not match the apex example.com
• exact mappings win over wildcard mappings
• overlapping wildcard mappings use the longest matching suffix

Closes #128.

Tests

Passed locally:

node --test test/qemu-net.test.ts
# tests 101, pass 101, fail 0

node /Users/shravansunder/.npm/_npx/12b05d58670d8359/node_modules/typescript/bin/tsc --noEmit --target es2022 --module NodeNext --moduleResolution NodeNext --strict --types node src/qemu/tcp.ts
# exit 0

git diff --check
# exit 0

Local environment note: this checkout did not have dependencies installed. I linked cached runtime packages to run the focused test. Attempts to run a clean package install/build locally were unreliable in this environment: one install attempt hit transient ENOTFOUND for registry.npmjs.org, and later npm/pnpm install attempts hung. A repo-wide no-emit TypeScript check with partial dependencies failed on missing/partial dependency types outside this change (@types/node-forge, @types/ssh2, cbor2, undici/Node 26 type mismatch). The changed src/qemu/tcp.ts module passes a narrow no-emit TypeScript check.