fix(auth): reject gitlab.io domains in DNS/HTTP token exchange

[latent-9]

What

Extends the shared-hosting rejection added in #1506 from github.io to gitlab.io (and subdomains) in ValidateDomainAndTimestamp, which guards both DNS and HTTP token exchange.

Why

GitLab Pages serves <group>.gitlab.io from the <group>/<group>.gitlab.io repository, and that repository can be written to by group members holding the Developer role — a far weaker bar than group ownership. The DNS/HTTP proof therefore demonstrates control of one Pages repository, yet it minted publish permissions for the entire io.gitlab.<group>/* namespace.

This is the same weaker-bar takeover #1506 closed for GitHub Pages; GitLab Pages is the identical mechanic (per-group Pages repository) and was notably absent from that fix.

Change

• New isGitLabPagesDomain check alongside isGitHubPagesDomain, with a distinct error message pointing GitLab users at apex-domain proof.
• Test-table rows covering my-group.gitlab.io (including mixed case and subdomains), plus lookalikes (gitlab.io.evil-example.com, my-group.gitlab.io.example.com) that must remain allowed.

Scope note: first-come-claimable hosts without an org-repository model (netlify.app, vercel.app, pages.dev) raise a different trust question and are deliberately left out of this PR.

[JosephDoUrden]

Pulled the branch, built and ran go test ./internal/api/handlers/v0/auth/..., green. The check sits in ValidateDomainAndTimestamp, which ExchangeToken shares for both the DNS and HTTP paths, so one place covers both. Same shape as the merged github.io fix in #1506, and the gitlab.io mechanic is the same, a group.gitlab.io repo lower-privileged members can publish to, so the proof is a weaker bar than namespace ownership. I also tried the trailing-dot form my-group.gitlab.io. to slip past the suffix match, and it still gets rejected, IsValidDomain drops it before it matters. The scope note leaving netlify/vercel/pages.dev out reads right to me, those are first-come and a different trust question. Looks merge-ready.