feat(access): Allow verified email domains

[nfebe]

Allow operators to grant visitor access to every verified address on an exact email domain. Subdomains and suffix lookalikes remain excluded. Requests outside the allowlist receive the same response without sending a verification link, so the configured domains are not disclosed.

[sourceant]

Code Review Summary

✨ Adds exact-domain entries to the visitor access allowlist. In internal/access/service.go, an allowlist entry beginning with @ is now normalized and matched against the requesting address's domain via a new emailDomain helper, so every verified address on that exact domain passes while subdomains and suffix lookalikes (sub.flatrun.dev, notflatrun.dev) do not. A new ValidAllowlistEntry accepts either a complete address or an @-prefixed domain (validated by prepending a placeholder local part to ValidEmail), and validateDomainAccess in internal/api/deployment_actions.go now uses it with an updated error message mentioning domains. Coverage was extended in internal/access/service_test.go for matching, rejection and entry validation (including @, @flatrun.dev@example.com and a bare domain), and internal/api/access_handlers_test.go walks an end-to-end request for a domain member alongside the existing per-address and denied cases. No review findings were supplied for this change.

🚀 Key Improvements

• internal/access/service.go supports @domain allowlist entries with exact-domain matching, keeping subdomain and suffix lookalikes out.
• ValidAllowlistEntry centralizes entry validation and is wired into validateDomainAccess in internal/api/deployment_actions.go, so bad domain entries are rejected at configuration time rather than silently ignored.
• Tests in internal/access/service_test.go and internal/api/access_handlers_test.go cover domain acceptance, case-insensitive matching, subdomain/lookalike rejection and the request handler path.

[sourceant]

Review complete. See the overview comment for a summary.

[sourceant]

ValidAllowlistEntry is the shared validator for the new @domain form, but its accepted grammar is not documented. In YAML specifically, a leading @ is a reserved indicator, so - @flatrun.dev in service.yml fails to parse; operators must quote it as - "@flatrun.dev". Record the accepted forms and the quoting requirement next to the validator so producers use it correctly.

Suggested change

	func ValidAllowlistEntry(value string) bool {
	// ValidAllowlistEntry reports whether value is a usable allowlist entry: either
	// a full email address, or an "@domain" entry that grants every verified address
	// on that exact domain (subdomains excluded). Matches are case-insensitive, and
	// because "@" is a reserved YAML indicator domain entries must be quoted in
	// service.yml, e.g. - "@example.com".
	func ValidAllowlistEntry(value string) bool {

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.