chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): a11oy_canonical_domain.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

a11oy_canonical_domain.py

@@ -5,20 +5,32 @@
 a11oy_canonical_domain.py — make a-11-oy.com the single canonical host.
 
 a11oy.net is SUNSET. This installs an app-level 301 redirect so any request whose
-Host header is a11oy.net (or www.a11oy.net) is permanently redirected to the same
-path+query on https://a-11-oy.com. The canonical HF Space host
-(szlholdings-a11oy.hf.space), localhost, and a-11-oy.com itself are passed through
-untouched, so the app keeps working on its origin while the public URL converges.
-
-This is a READ-PATH-SAFE redirect: it is a pure 308/301 Location response, mints no
+Host header is on the a11oy.net domain — the apex (a11oy.net), www, OR ANY
+subdomain (*.a11oy.net) — is permanently redirected to the same path+query on
+https://a-11-oy.com. The canonical HF Space host (szlholdings-a11oy.hf.space),
+localhost, and a-11-oy.com itself are passed through untouched, so the app keeps
+working on its origin while the public URL converges.
+
+Doctrine ("No a11oy.net on user surfaces"): matching only the apex + www left a
+real gap — any OTHER a11oy.net host (e.g. app.a11oy.net, a stray CNAME) fell
+through and SERVED user surfaces on .net. The match is host-suffix based so no
+a11oy.net host can serve user content; every one of them is redirect-only.
+
+This is a READ-PATH-SAFE redirect: it is a pure 301 Location response, mints no
 receipt, signs nothing, and touches no state (provenance rule: never sign on a read
 path). Doctrine-safe: try/except-guarded register(app).
 """
 
 CANONICAL_HOST = "a-11-oy.com"
 
-# Hosts that should be permanently redirected to the canonical host.
-SUNSET_HOSTS = {"a11oy.net", "www.a11oy.net"}
+# The sunset domain. Any host that IS this apex or ends with ".<apex>" (i.e. any
+# subdomain) is redirect-only and must never serve a user surface.
+SUNSET_DOMAIN = "a11oy.net"
+
+
+def _is_sunset_host(host: str) -> bool:
+    """True if `host` is the a11oy.net apex or any of its subdomains."""
+    return host == SUNSET_DOMAIN or host.endswith("." + SUNSET_DOMAIN)
 
 
 def register(app):
@@ -28,7 +40,7 @@ def register(app):
     @app.middleware("http")
     async def _canonical_host_redirect(request, call_next):
         host = (request.headers.get("host") or "").split(":")[0].lower()
-        if host in SUNSET_HOSTS:
+        if _is_sunset_host(host):
             target = f"https://{CANONICAL_HOST}{request.url.path}"
             if request.url.query:
                 target = f"{target}?{request.url.query}"
@@ -36,4 +48,4 @@ def register(app):
             return RedirectResponse(url=target, status_code=301)
         return await call_next(request)
 
-    return [f"301 {h} -> https://{CANONICAL_HOST}" for h in sorted(SUNSET_HOSTS)]
+    return [f"301 {SUNSET_DOMAIN} (+ *.{SUNSET_DOMAIN}) -> https://{CANONICAL_HOST}"]