Feature: expand associated-domain support beyond the demo domain

[jmcte]

Problem

The v2 native app currently supports only https://example.com as a demo associated domain. Real-world deployments require credentials for production domains, which means:

1. The app's Associated Domains entitlement must list each target domain.
2. Each domain must serve an apple-app-site-association (AASA) file at /.well-known/apple-app-site-association.
3. After adding domains, the app must be re-signed and re-notarized.
4. There is no current mechanism for operators to declare which domains they need without modifying the entitlement plist and rebuilding.

Proposed Fix

Short term:

• Document the full domain expansion process (AASA file format, entitlement update, notarization) in docs/INSTALLATION.md or a new docs/DOMAIN_EXPANSION.md.

Medium term:

• Define a supported_domains field in ~/.apw/config.json that is validated at runtime against the app's embedded entitlements (so the config cannot claim more domains than the app is entitled to).
• Add a apw doctor check that verifies each configured domain has a reachable and valid AASA file.

Long term:

• Investigate whether a multi-tenant entitlement approach (wildcard subdomain or managed capability) reduces the per-domain rebuild requirement.

Acceptance Criteria

• Domain expansion process is documented end-to-end.
• apw doctor reports a clear error for domains missing a valid AASA file.
• Adding a new domain does not require source code changes — only config and entitlement updates.
• At least one production domain is tested in the extended validation suite before shipping.

[jmcte]

Initial pass on branch claude/close-open-issues-MTlan (commit 10e614e).

Landed:

• New docs/DOMAIN_EXPANSION.md is the operator playbook: config field, entitlement update, AASA hosting requirements, rebuild / re-sign / re-notarize flow, and verification via apw doctor.
• New apw doctor check associated-domains (in rust/src/doctor.rs) probes each domain listed in APW_AASA_DOMAINS (comma-separated) for a reachable /.well-known/apple-app-site-association and returns a typed [FAIL] with a remediation pointer to the playbook on misses.
• The env-var gate lets this ship ahead of the supportedDomains config schema change without breaking existing installs.

Open (medium-/long-term per the issue):

• supportedDomains field on APWConfigV1 and runtime validation against the bundle's embedded entitlements — not yet wired.
• Wildcard / managed-capability investigation — not started.

---

Generated by Claude Code