docs: add platform/packages/onlyoffice.docs localhost sites + cert regen to Caddy docs

- Added platform.localhost (-> localhost:10080) and packages.localhost
  (-> localhost:20080) to stack.md sites table (total now 17)
- Documented onlyoffice.docs.localhost (pre-existing in Caddy config, was undocumented)
- Regenerated mkcert cert with explicit SANs for the 3 new hostnames
  (onlyoffice.docs.localhost is multi-label, not covered by *.localhost wildcard)
- Fixed wildcard note: multi-label hosts require explicit SANs
- Updated manual-overrides with cert regeneration row + site delta
- Updated CHANGELOG with cert regen + site additions

docs/tech/stack.md

@@ -6,7 +6,7 @@ tags:
   - software-stack
   - inventory
   - tech-stack
-last_updated: '2026-07-06'
+last_updated: '2026-07-12'
 ---
 
 # Software Stack - mw-pfeddersheim-workstation
@@ -107,9 +107,9 @@ for the active Caddy/OnlyOffice investigation.
 | Package | `caddy` (pacman) |
 | Service | `caddy.service` (enabled, runs as `caddy` user) |
 | Config | `/etc/caddy/Caddyfile` + `/etc/caddy/conf.d/localhost-dev.conf` |
-| TLS | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem` |
+| TLS cert | mkcert-generated pair at `/etc/caddy/localhost{,-key}.pem`; includes explicit SANs for all 19 hostnames (wildcard `*.localhost` only covers single-label subdomains like `mcp.localhost`; multi-label hosts like `onlyoffice.docs.localhost` and `demo.satware.com.localhost` require explicit SANs) |
 | Admin endpoint | Unix socket `/run/caddy/admin.socket` |
-| Sites | 14 `*.localhost` virtual hosts (see table below) |
+| Sites | 17 `*.localhost` virtual hosts (see table below) |
 
 #### `*.localhost` sites
 
@@ -120,10 +120,13 @@ for the active Caddy/OnlyOffice investigation.
 | `onlyoffice.localhost` | `reverse_proxy localhost:3847` | OnlyOffice MCP server; emitting `context canceled` SSE aborts (issue [#92](https://gitlab.satware.com/satware/mcp/onlyoffice/-/work_items/92)) |
 | `project-1.localhost` ... `project-10.localhost` | `respond "project-N - placeholder"` | 10 reserved placeholders |
 | `demo.satware.com.localhost` | `reverse_proxy localhost:38081` | webdevops/php-apache-dev container |
+| `platform.localhost` | `reverse_proxy localhost:10080` | amicron-platform Docker (Symfony 7.4 + Vue 3 + Firebird 3.0.14); `~/internal/amicron-platform` |
+| `packages.localhost` | `reverse_proxy localhost:20080` | satis Docker (Composer package repository with token-based access control); `~/internal/satis` |
+| `onlyoffice.docs.localhost` | `file_server` root `/home/mw/internal/onlyoffice/docs-site/dist` | Starlight static docs build |
 
-Wildcard cert covers one level only. `demo.satware.com.localhost` works
-(single label under `*.localhost`); deeper nesting (e.g.
-`sub.demo.satware.com.localhost`) would NOT be covered.
+Wildcard `*.localhost` only matches single-label subdomains (e.g. `mcp.localhost`).
+Multi-label hosts like `onlyoffice.docs.localhost` and `demo.satware.com.localhost`
+require explicit SANs in the mkcert cert - they are NOT covered by the wildcard.
 
 ### Useful Caddy commands