fix: Validate twingate.host and twingate.network against trusted domains

[minhtule]

Related Tickets & Documents

• Issue: Validate the Twingate controller host and network so the JWKS trust anchor can't point at an untrusted domain #352
• Stacked on refactor: move Twingate backend config into config package #358; review/merge that first.

Changes

• Validate twingate.network is a single DNS label, since it is interpolated into the JWKS URL authority.
• Validate twingate.host against the trusted Twingate domains, matched case-insensitively, using the same allowlist as token issuer validation so an accepted host always has a known JWT issuer.
• Re-validate the resolved host after redirect, keeping the configured host if the redirect target is not trusted.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.16%. Comparing base (5bd5661) to head (bc76588).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                        Coverage Diff                        @@
##           feat/mt/parser-config-helpers     #359      +/-   ##
=================================================================
- Coverage                          86.19%   86.16%   -0.04%     
=================================================================
  Files                                 40       40              
  Lines                               2833     2848      +15     
=================================================================
+ Hits                                2442     2454      +12     
- Misses                               265      269       +4     
+ Partials                             126      125       -1     

Flag	Coverage Δ
integration	54.68% <11.76%> (-0.37%)	⬇️
unit	78.68% <100.00%> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
internal/config/config.go	89.71% <100.00%> (+0.57%)	⬆️
internal/connect/connect.go	97.72% <100.00%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds defensive validation around the Twingate controller trust anchor by constraining both twingate.network and twingate.host to safe DNS forms and to an explicit trusted-domain allowlist (aligned with issuer selection), including after controller redirects.

Changes:

• Validate twingate.network as a single DNS label to prevent authority/host injection in the JWKS URL construction.
• Validate twingate.host as a well-formed hostname and require it to match a trusted Twingate domain (case-insensitive).
• When resolving the controller host via redirect, re-validate the resolved hostname and fall back to the configured host if the redirect target is untrusted.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
internal/config/config.go	Adds network/host validation (regex + trusted-domain allowlist) and re-validates redirect-resolved hostnames before accepting them.
internal/config/config_test.go	Extends tests to cover invalid network values, trusted/untrusted hosts (including case-insensitive suffix matching), and redirect fallback behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[clement0010]

LGTM 👍🏻