feat(domains): add allowed-domain repository and whitelist check

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/integration/whitelist.test.ts

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { openInMemoryForTest } from '../../src/lib/server/db';
+import { addDomain, listDomains, removeDomain } from '../../src/lib/server/domains/repository';
+import { isDomainAllowed } from '../../src/lib/server/domains/whitelist';
+
+describe('allowed domains', () => {
+  it('round-trips domains', () => {
+    const db = openInMemoryForTest();
+    addDomain(db, 'chefkoch.de', 'Chefkoch');
+    addDomain(db, 'emmikochteinfach.de', 'Emmi kocht einfach');
+    const all = listDomains(db);
+    expect(all.map((d) => d.domain).sort()).toEqual(['chefkoch.de', 'emmikochteinfach.de']);
+  });
+
+  it('normalizes www. and case', () => {
+    const db = openInMemoryForTest();
+    addDomain(db, 'WWW.Chefkoch.DE');
+    expect(isDomainAllowed(db, 'https://chefkoch.de/abc')).toBe(true);
+    expect(isDomainAllowed(db, 'https://www.chefkoch.de/abc')).toBe(true);
+    expect(isDomainAllowed(db, 'https://fake.de/abc')).toBe(false);
+  });
+
+  it('rejects invalid urls', () => {
+    const db = openInMemoryForTest();
+    addDomain(db, 'chefkoch.de');
+    expect(isDomainAllowed(db, 'not a url')).toBe(false);
+  });
+
+  it('removes domains', () => {
+    const db = openInMemoryForTest();
+    const d = addDomain(db, 'chefkoch.de');
+    removeDomain(db, d.id);
+    expect(listDomains(db)).toEqual([]);
+  });
+});