[chris-allen]

On a machine that shares (#41), a context that isn't running showed a certificate error where grove means to show its "nothing bound" page.

Why

An unrouted name gets a shared wildcard instead of a leaf of its own, so made-up names can't make the daemon sign one apiece (#40). That wildcard was always *.grov.site, which covers exactly one label. Sharing puts every hostname two labels deep, <context>.<host>.grov.site, so the wildcard covered none of them. After a reboot ended a stack's leases, a phone opening its URL saw a certificate for the wrong name and called it untrusted.

Change

• The issuer knows the machine's zone. An unrouted name one label under it gets the zone's own wildcard, *.<host>.grov.site. One-label names still get *.grov.site.
• Minting stays bounded at those two wildcards, whatever names a client offers.
• The HTTPS concept page describes both.

Testing

• go test -race -count=1 ./..., go vet ./..., gofmt -l ., and the docs link check.
• A new issuer test offers 50 made-up names under the zone, checks each is covered, and checks only two leaves are signed.
• On a sharing machine, an unrouted nothing-here.regulus.grov.site now serves *.regulus.grov.site and the 503 page, verified against the machine's root, while a routed name still gets its own leaf.