feat: custom TLD virtual hosts with SNI certs, dynamic PAC, and TLD validation

- Add isValidVhostHostname() to dashboard.js with embedded REAL_TLDS and
  REAL_SLD_TLDS blocklists; enforces 3-label minimum (two-tier TLD requirement),
  valid label characters, and blocks real public TLDs/SLDs (e.g. .com, co.uk)
- Replace hardcoded .hole.sail validation in vhost submit handler with new validator
- Update Add Virtual Host modal hint text and add inline format explanation
- Update applyPAC() in background.js to accept a tlds array, generating one
  dnsDomainIs clause per unique two-label base domain; .hole.sail always included
- Store virtualHosts in extensionState and pass derived TLD list to applyPAC at
  every getState response and retryGetStateForConnectProxy call
- Replace single upfront *.hole.sail cert in https-proxy.js with SNICallback that
  lazily generates a wildcard cert per two-label base domain on first connection;
  baseline *.hole.sail cert still pre-generated at startup
- Add chrome.permissions.request() in background.js send handler to grant host
  permissions for new TLDs dynamically after successful setVirtualHost
- Add optional_host_permissions: ["*://*/*"] and "permissions" to manifest.json
  to enable runtime host permission grants for custom TLDs

extension/dashboard.html

@@ -1580,8 +1580,9 @@
     <div class="modal-body">
       <p class="modal-desc">Assign a hostname to an hs:// tunnel URL. The host will be accessible at <code style="font-family:'JetBrains Mono',monospace;font-size:11px;color:var(--cyan);">https://&lt;hostname&gt;</code> via the proxy.</p>
       <div class="form-group">
-        <label class="form-label" for="addVhostHostname">Hostname <span class="form-hint">(must end with .hole.sail)</span></label>
+        <label class="form-label" for="addVhostHostname">Hostname <span class="form-hint">(e.g. myapp.hole.sail or api.my.internal — no real TLDs)</span></label>
         <input type="text" id="addVhostHostname" class="input mono" placeholder="myapp.hole.sail" autocomplete="off" spellcheck="false">
+        <div style="font-size:11px;color:var(--text4);margin-top:4px;line-height:1.5;">Must be <code style="font-size:10px;">host.second.tld</code> format with a private TLD (3 labels minimum). Real TLDs like <code style="font-size:10px;">.com</code>, <code style="font-size:10px;">.co.uk</code> are not allowed.</div>
       </div>
       <div class="form-group">
         <label class="form-label" for="addVhostHsUrl">hs:// URL</label>