fix(security): validate application domains safely

Use shared domain validation and normalization for application, service, and
preview domains so unsafe host input is rejected consistently.

Cover command-substitution payloads in application domain tests.

tests/Feature/Livewire/ApplicationGeneralDockerRegistryImageValidationTest.php

@@ -2,6 +2,40 @@
 
 use App\Livewire\Project\Application\General;
 
+it('uses safe domain validation rules in the application general form', function () {
+    $component = new General;
+    $method = new ReflectionMethod($component, 'rules');
+    $rules = $method->invoke($component);
+
+    $validator = validator([
+        'fqdn' => 'http://$(whoami).example.com',
+    ], [
+        'fqdn' => $rules['fqdn'],
+    ]);
+
+    expect($validator->fails())->toBeTrue()
+        ->and($validator->errors()->has('fqdn'))->toBeTrue();
+});
+
+it('uses safe docker compose service domain validation rules in the application general form', function () {
+    $component = new General;
+    $method = new ReflectionMethod($component, 'rules');
+    $rules = $method->invoke($component);
+
+    $validator = validator([
+        'parsedServiceDomains' => [
+            'app' => [
+                'domain' => 'http://$(whoami).example.com',
+            ],
+        ],
+    ], [
+        'parsedServiceDomains.*.domain' => $rules['parsedServiceDomains.*.domain'],
+    ]);
+
+    expect($validator->fails())->toBeTrue()
+        ->and($validator->errors()->has('parsedServiceDomains.app.domain'))->toBeTrue();
+});
+
 it('uses safe docker registry image validation rules in the application general form', function () {
     $component = new General;
     $method = new ReflectionMethod($component, 'rules');