epic: online public tenant routing, news routes, and tenant domain management #555

Objective

Define and implement an online-primary public routing capability for AWCMS-Mini while preserving the existing offline/LAN-first operational capability.

Context

AWCMS-Mini already has tenant-aware modular monolith foundations, RBAC/ABAC/RLS, module management, audit logging, and offline/LAN deployment support. Public website/SaaS use cases now need clean, SEO-friendly, white-label public URLs without requiring tenantCode in the path.

Target routing model:

Domain/Subdomain -> Public Tenant Resolver -> Tenant Context -> /news Public Routes -> blog_content

Scope

• Online-primary public tenant routing mode.
• Tenant domain/subdomain mapping.
• Default public tenant resolver with offline/LAN fallback.
• /news public routes for blog_content.
• Legacy /blog/{tenantCode} compatibility documentation.
• Tenant module presets and tenant-module matrix UI.
• Optional Cloudflare DNS adapter as a later enhancement.

Out of scope

• Runtime plugin upload.
• Module marketplace.
• Automatic domain purchase/registrar integration.
• Making Cloudflare DNS automation a hard dependency.
• Removing legacy /blog/{tenantCode} routes in the MVP.
• Removing offline/LAN-first capability.

Acceptance criteria

• Public URLs can work without tenant code.
• Full online mode can resolve tenant from domain/subdomain.
• Offline/LAN deployments can still fallback to env/setup default tenant.
• Unknown, failed, suspended, or inactive domain/tenant states do not leak tenant existence.
• /news routes resolve content for the correct tenant.
• Disabled modules remain blocked server-side, not only hidden in UI.
• New env vars are documented and covered by config:validate tests.
• OpenAPI/docs/tests are updated as relevant.

Security notes

• Keep tenant isolation through tenant_id, withTenant, RBAC/ABAC, and PostgreSQL RLS.
• Do not store provider secrets in module descriptors or DB.
• Do not trust X-Forwarded-Host unless explicitly configured behind a trusted proxy.
• All domain/module mutations must be audited.

Child issues

Create/implement child issues for:

1. Online public mode config.
2. Tenant domain schema.
3. Tenant domain module descriptor.
4. Public host tenant resolver.
5. /news public routes.
6. Legacy blog route documentation.
7. Tenant domain API.
8. Tenant domain admin UI.
9. Blog-content public route settings.
10. Tenant module presets.
11. Tenant-module matrix UI.
12. Optional Cloudflare DNS adapter.