Public HTTPS URLs for devenv processes, with safe URL retirement

Allow users to expose selected processes through the existing proxy using public HTTPS URLs, for example:

devenv share web
→ https://myapp-k7m2q9.<sharing-domain>

Each share should include the project name and a random suffix, allowing many instances of the same project to run in parallel without reservations.

The proposed architecture is a public Rust gateway forwarding traffic over iroh to the local devenv proxy. Hosting should have predictable bandwidth costs, such as a server with unmetered traffic. Domain, transport, and suffix length remain design decisions.

Shipping blocker: URL reuse

An expired share URL must not later serve an unrelated environment. Old links, webhook configurations, cookies, and browser state can outlive the original share. Reassigning that hostname could send traffic or credentials intended for the original project to another user.

Checking uniqueness only among active shares does not solve this. Randomness reduces accidental collisions but does not establish a lifetime ownership policy.

We need to decide:

• Whether issued hostnames are permanently retired, and how that history survives restarts, migrations, and database recovery.
• Whether an original share can reclaim its URL after disconnecting, and what credential proves continuity.
• Whether six base32 characters provides enough space when accounting for all historical shares with a common project name.
• Whether permanent tombstones, a non-repeating allocation scheme, or another approach provides the right guarantees.
• How browser-origin isolation works between shares, including Public Suffix List registration.

Acceptance criteria

• Parallel shares receive distinct project-prefixed URLs.
• Retired URLs never silently route to unrelated shares.
• Reconnection and expiration behavior is documented, with authenticated reconnection.
• Allocation remains safe under concurrent requests and forced random collisions.
• Tests cover retirement, unauthorized reclamation, stale reconnect credentials, and recovery.
• HTTP streaming and WebSocket/HMR work through the tunnel.
• User documentation and devenv-run-tests coverage accompany the feature.

Next step

Resolve the URL lifecycle design first, then prototype the gateway. Permanent retirement is the starting preference; a non-repeating allocation scheme is the main alternative to investigate.