- New site: https://agent0.localhost -> reverse_proxy 192.168.0.141:8090
(first non-localhost backend; remote LAN host running uvicorn)
- Config in dedicated /etc/caddy/conf.d/agent0.localhost.conf
- Regenerated mkcert cert: 19 -> 20 SANs, valid until 2028-10-21
- Key learning: *.localhost wildcard is NOT honored by curl/system
trust even for single-label subdomains - .localhost is a special-use
TLD per RFC 6761; every subdomain needs an explicit SAN. Corrects
prior assumption in stack.md and manual-overrides.md.
Updates: docs/tech/stack.md, docs/tech/manual-overrides.md, CHANGELOG.md
mw
cd63df4f59