Add wildcard_matchAny routing mode for wildcard hosts

A *.example.com wildcard host now chooses between two routing modes:
- wildcard_matchAny=false (default): only subdomains explicitly defined
  in redis route; undefined subdomains get no match (406)
- wildcard_matchAny=true: any subdomain catches-all to the wildcard
  parent host, preserving the previous behavior

The gate lives in the host_lookup socket service, which is only reached
for domains missing a direct redis entry, so defined children and
**-style hosts are unaffected. Adds the matching-mode selector to the
host add/edit form, shown for wildcard hosts.

Note: existing wildcard hosts have no wildcard_matchAny field and so
default to the stricter "only defined" mode until re-saved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nodejs/services/host_lookup.js

@@ -35,6 +35,16 @@ const socket = new SocketServerJson({
 			// If we don't have a match, return empty object
 			if(!parentHost) return clientSocket.write(JSON.stringify({}));
 
+			// A wildcard host with matchAny disabled only serves subdomains that
+			// are explicitly defined in redis. Reaching this service means redis
+			// had no direct entry for the requested domain, so an inexact match
+			// here (the request isn't the wildcard host itself) is an undefined
+			// subdomain and must not be routed to the wildcard parent.
+			if(parentHost.is_wildcard && !parentHost.wildcard_matchAny
+					&& parentHost.host !== data['domain']){
+				return clientSocket.write(JSON.stringify({}));
+			}
+
 			// If the matched host belongs to a wildcard domain, set wildcard_parent
 			// This allows child domains to use the parent's wildcard SSL certificate
 			if(!parentHost.wildcard_parent){