dev-tunnel: support bare hostnames (e.g. retrotool.tom.u2i.me) in addition to wildcards

[pinetops]

Problem

dev-tunnel setup <user> [project] only supports wildcard hostnames of the form *.<project>.<user>.u2i.me. There's no way to set up a bare hostname like <project>.<user>.u2i.me (e.g. retrotool.tom.u2i.me directly, instead of app.retrotool.tom.u2i.me).

For projects that want a single bare URL rather than a subdomain pattern, users have to fall back to manually editing ~/.cloudflared/<tunnel>.yml ingress rules and adding DNS records via the Cloudflare dashboard, defeating the point of the CLI.

Use case

I want http://retrotool.tom.u2i.me/ to point at my local retrotool dev server, just like app.teamology.tom.u2i.me points at teamology. The tool can do the wildcard variant cleanly; the bare variant is currently a manual workaround.

Proposed shape

A flag (or separate command) on setup that creates a bare-hostname tunnel:

dev-tunnel setup tom retrotool --bare
# or
dev-tunnel setup-bare tom retrotool

Either form should:

• Create a CNAME / DNS record for the bare retrotool.tom.u2i.me (not the wildcard)
• Generate a single-hostname SSL cert
• Write an ingress rule with the literal hostname (no glob)
• Save the token to 1Password under the same naming scheme as today

Bare and wildcard could coexist on different tunnels per project, so the existing wildcard flow shouldn't change.

Workaround (for the record)

Manual cloudflared config + Cloudflare DNS dashboard. Works but bypasses the CLI's whole point.

Context

• Filed while setting up retrotool dev locally; the existing dev-tunnel setup tom retrotool would create *.retrotool.tom.u2i.me which works, but I want the bare hostname for parity with how the project's compose APP_HOSTNAME and ROOT_URL are usually configured.
• Repo is currently mid-refactor on merge-dev-tunnel branch (merging proxy management into dev-tunnel); whoever picks this up should decide whether to land it on main or on that branch.

[pinetops]

This already landed as part of the merge-dev-tunnel refactor (bin/dev-tunnel, currently untracked locally — about to be committed on that branch).

dev-tunnel setup <user> [project] now creates both the bare and wildcard variants on the same tunnel:

• DNS: CNAME for <project>.<user>.u2i.me and *.<project>.<user>.u2i.me → tunnel target
• SSL: a single advanced cert pack covering both hosts (TXT validation records auto-created)
• Ingress: rules for both literal bare and wildcard, both pointing at the local Traefik port
• 1Password: token saved under the existing Cloudflare Tunnel Token (<tunnel-name>) scheme

Example: dev-tunnel setup tom retrotool → https://retrotool.tom.u2i.me and https://<svc>.retrotool.tom.u2i.me on tunnel retrotool-tom.

This collapses the bare and wildcard into one tunnel rather than the "different tunnels per project" option floated in the issue — simpler and matches the stated use case (parity with app.teamology.tom.u2i.me). If we ever need them on separate tunnels, we can add a flag then.

Closing as done on merge-dev-tunnel.