Use per-deploy preview hosts under the site root domain.

Build hosts as <userPrefix>-<deploymentNumber>-preview.<rootDomain> from FRONTEND_URL, wire them through ingress/TLS, and open them from the preview API.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/helm/cloudhost-app/templates/ingress.yaml

@@ -2,6 +2,7 @@
 {{- $name := include "cloudhost-app.name" . -}}
 {{- $ns   := include "cloudhost-app.namespace" . -}}
 {{- $host := printf "%s.%s" (default $name .Values.ingress.subdomain) .Values.ingress.domain -}}
+{{- $previewHost := .Values.ingress.previewHost | default "" -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -36,11 +37,26 @@ spec:
                 port:
                   number: 80
     {{- end }}
+    {{- if $previewHost }}
+    - host: {{ $previewHost }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $name }}
+                port:
+                  number: 80
+    {{- end }}
   tls:
     - hosts:
         - {{ $host }}
         {{- if .Values.ingress.customDomain }}
         - {{ .Values.ingress.customDomain }}
         {{- end }}
+        {{- if $previewHost }}
+        - {{ $previewHost }}
+        {{- end }}
       secretName: {{ $name }}-tls
 {{- end }}

backend/helm/cloudhost-app/values.yaml

@@ -39,6 +39,10 @@ ingress:
   clusterIssuer: letsencrypt-prod
   customDomain: ""         # Optional custom domain (e.g. "www.example.com")
 
+  # Optional additional host for per-deployment preview (e.g. abc123.platform.example.com).
+  # When set, the ingress will route traffic for this host to the same service and include it in TLS SANs.
+  previewHost: ""
+
 # ── Database (MySQL or PostgreSQL) ───────────────────────
 database:
   enabled: false