feat(blocklist): block domains listed in config.json at the cache-bucket root

[robbiebyrd]

What

Adds an optional domain blocklist to the time-machine-web-proxy. An optional config.json at the root of the shared cache bucket (FUSE-mounted at CACHE_DIR) stops the proxy from retrieving, caching, or serving matching hosts.

{
  "blocked_domains": ["example.com", "*.tracker.net"]
}

Behavior

• blocked_domains — array of hosts. Wildcard entries (*.example.com) use the same subdomain+apex semantics as WHITELIST_HOSTS.
• Missing file → no blocklist. No error is raised when config.json is absent.
• Malformed file → keeps the previously loaded list (fails safe, doesn't crash).
• Blocked requests return a distinct HTTP 451 on every path: HTTP, SSE, WebSocket, and admin crawl.
• Prewarm skips blocked asset hosts embedded in otherwise-allowed pages.
• The file is re-read at most once per minute, so bucket edits apply without a restart.

Files

• src/lib/blocklist.ts (new) — core loader + matcher
• src/lib/dependencies.ts, src/services/proxy.ts, src/services/time-machine.ts — wiring
• tests/lib/blocklist.test.ts, tests/services/proxy.test.ts — coverage
• README.md — docs

🤖 Generated with Claude Code