fix(nginx-proxy)!: apply wildcard htpasswd and ACL only to *.X hosts

[mrrobot47]

Summary

The wildcard htpasswd lookup added in #298 counted labels on the host instead of matching the site. A subsite of a subdomain multisite with 4+ labels (*.ms.dev.example.com) never found _wildcard.ms.dev.example.com, while an unrelated site like shop.example.com picked up _wildcard.example.com and asked for another site's credentials.

A _wildcard.X file now applies only to the literal *.X host. Every other host uses its exact file or falls back to default.

Changes

• nginx.tmpl: the htpasswd lookup is exact host → _wildcard.X for a *.X host → default. The label-counting fallback is removed.
• nginx.tmpl: the ACL include uses the same mapping (vhost.d/_wildcard.X_acl for *.X hosts) through one acl template, also for the mailhog and /ee-admin/ locations, so per-site IP whitelists apply to subdomain hosts too.
• README.md: describes the *.X-only lookup and the file names.

Breaking change: _wildcard.X no longer applies to X itself, which needs its own htpasswd/X (and vhost.d/X_acl) file. Setups that relied on the #298 fallback (_wildcard.<last 3 labels>, then _wildcard.<last 2 labels>) to protect other hosts must add exact files for them. auth-command (EasyEngine/auth-command#57) writes the file each served host needs, and its upgrade migration regenerates them.

Release / merge order

These PRs ship together in one core release:

• fix(nginx-proxy)!: apply wildcard htpasswd and ACL only to *.X hosts #354: new easyengine/nginx-proxy template (needs a new dockerfiles tag)
• feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains auth-command#57: wildcard and alias domain auth files, alias domain hooks, upgrade migration
• feat(site): add alias domain hooks and validate alias domain names site-command#502: alias domain hooks, alias domain validation, delete cleanup left to auth-command
• fix(site): validate alias domain names on site create site-type-wp#239 and fix(site): validate alias domain names on site create site-type-php#114: alias domain validation on site create

Order:

1. Merge the dockerfiles PR, tag a new dockerfiles release and confirm the new easyengine/nginx-proxy image is on Docker Hub.
2. Merge the site-command, auth-command, site-type-wp and site-type-php PRs close together (nightly and PR CI build dev-develop of every package) and tag each package.
3. In one core release, bump the four package pins and easyengine/nginx-proxy in img-versions.json together.

Why they are coupled:

• auth-command's container migration regenerates every site's auth files on upgrade and needs the new nginx-proxy image in the same release: the old template applies a _wildcard.X file to sibling sites too (e.g. shop.example.com picks up _wildcard.example.com).
• auth-command syncs alias domain auth files from the site_alias_domains_before_update, site_alias_domains_updated and site_alias_domains_update_failed hooks, which only the new site-command fires.
• site-command no longer removes a site's auth files and rows on site delete; auth-command's site_cleanup hook (autoloaded since feat(auth): support http auth and ip whitelist on wildcard subdomains and alias domains auth-command#57) does it.
• site-type-wp and site-type-php call site-command's new split_alias_domains() and validate_alias_domains(); with an older site-command, site create fails with a fatal "undefined function" error.
• The dockerfiles change is breaking for hand-made feat(nginx-proxy): Add wildcard HTTP auth support for WordPress multisite #298-style _wildcard.X files that were also relied on to protect X itself: X now needs its own htpasswd/X (and vhost.d/X_acl) file.

Testing

• Tested on a live EasyEngine 4.12 install with html, php, wp, wp subdir and wp subdom sites, with plain and *. aliases, multiple users, global auth, IP whitelists, alias add/remove, site delete, self-signed SSL and Let's Encrypt.
• Rendered the template with docker-gen on nginx-proxy 1.11.2 and 1.11.6.