Add v1 shortener: Bearer API, public 302, landing, and CI.

Standalone Django service so callers can mint links and phones get a 302.
Closes #1.

site/links/middleware.py

@@ -0,0 +1,68 @@
+"""Keep the short domain and Django admin off the public API hostname."""
+
+from __future__ import annotations
+
+from django.conf import settings
+from django.http import Http404, HttpRequest
+
+
+def _normalize_host(host: str) -> str:
+    return host.split(":")[0].lower().rstrip(".")
+
+
+def _host_in(host: str, configured: list[str]) -> bool:
+    needle = _normalize_host(host)
+    raw = host.lower()
+    for entry in configured:
+        if not entry:
+            continue
+        if raw == entry.lower() or needle == _normalize_host(entry):
+            return True
+    return False
+
+
+def is_api_host(host: str) -> bool:
+    return _host_in(host, list(getattr(settings, "SHORT_API_HOSTS", []) or []))
+
+
+def is_public_host(host: str) -> bool:
+    return _host_in(host, list(getattr(settings, "SHORT_PUBLIC_HOSTS", []) or []))
+
+
+def is_admin_host(host: str) -> bool:
+    return _host_in(host, list(getattr(settings, "SHORT_ADMIN_HOSTS", []) or []))
+
+
+class HostSplitMiddleware:
+    """Short host = redirects only. API host = /api/ (Bearer). Admin = local only.
+
+    A public DNS name may be listed in SHORT_API_HOSTS. Auth, not the network,
+    keeps /api/ closed: missing/wrong Bearer is 401; empty token list is 503.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest):
+        path = request.path
+        if path in {"/healthz", "/healthz/"}:
+            return self.get_response(request)
+
+        host = request.get_host()
+
+        if path.startswith("/debug"):
+            if not settings.DEBUG or is_public_host(host):
+                raise Http404()
+            return self.get_response(request)
+
+        if path.startswith("/admin"):
+            if not is_admin_host(host):
+                raise Http404()
+            return self.get_response(request)
+
+        if path.startswith("/api/"):
+            # Short redirect hostname never serves the API, even if mis-listed.
+            if is_public_host(host) or not is_api_host(host):
+                raise Http404()
+
+        return self.get_response(request)