Validate Domain routes (S-003-1, S-003-8..12) #159

Builds part of spec S-003, docs/specs/003-domain-routes.md (feature issue #90): the acceptance criteria below. Each needs a test that names its id (test_s003_<k>_..., or a proves: S-003-1 comment line).

This is the routes schema and its cloudfall config validate checks.

• S-003-1: A Domain with a /api/ proxy route and a / static route with spaFallback: index.html passes cloudfall config validate
• S-003-8: A Domain with two routes for the same path fails cloudfall config validate with exit CONFIG_INVALID and code domain_route_path_duplicate
• S-003-9: A Domain with both proxy.upstream and routes fails cloudfall config validate with code domain_route_source_invalid, and a Domain with neither still passes it
• S-003-10: A route path under /.well-known/acme-challenge fails with domain_route_path_reserved, and a static route path without a trailing / or a path with a space, ; or { fails with domain_route_path_invalid
• S-003-11: A static route naming a missing component fails with resource_reference_missing, and one whose component doesn't list the Domain's proxy.server fails with domain_route_component_not_on_proxy
• S-003-12: A static route whose directory or spaFallback contains a .. segment or is absolute, or whose directory is ., fails cloudfall config validate