Host Validation

RuniqueApp::builder(config)
    .middleware(|m| {
        m.with_allowed_hosts(|h| {
            h.enabled(!is_debug())  // disabled in dev, active in prod
             .host("mysite.com")
             .host("www.mysite.com")
             .host("mysite.up.railway.app")
        })
    })

// If the Host header of the request does not match
// any allowed host:
//   → 400 Bad Request

// Comparison: case-insensitive, IPv6 normalisation
// Wildcards:
//   .example.com  →  accepts foo.example.com, bar.example.com
//   (does not match example.com without a subdomain)

// Disabled when enabled(false) — all requests pass through.