[chris-allen]

A wildcard certificate covers exactly one label, which is what keeps every context at <context>.grov.site. Tailnet mode will want names like app.capella.grov.site, one per host, and DNS already resolves names that deep. This change lets the certificates follow.

• The daemon signs a leaf per routed hostname, on first use, from the same root. Today's one-label names are unaffected beyond getting a leaf of their own.
• Names grove doesn't route, the apex included, share one *.grov.site leaf. Once the daemon answers on the tailnet, any peer can offer any hostname, so only names the proxy routes may cost a signature.
• Names outside the domain are still refused, so the trusted root can't sign for anything else.

Testing

• go test -race -count=1 ./..., go vet ./..., gofmt -l .
• A real TLS handshake and routed response on a two-label hostname through the proxy.
• 50 invented names plus the apex sign two leaves in total: the routed name and the shared wildcard.

The docs' HTTPS page and the README pitch no longer describe a single wildcard certificate.