fix(lookup): fan a redirect out only to the networks its target is served in

network_redirects gave every network sibling of a source the mapping, and redirect-domain.conf.j2 falls back to the canonical target when the target has no sibling in the source's network. Since e4fd4552f0 schedules the clearnet apex entry without web-opt-rdr-domains in the round, its fan-out rendered a vhost for the bare node onion pointing at the clearnet homepage in every multi-network round without an onion dashboard: the CSP health check of API#1 and OnlyOffice#1 in run 40109131688 failed with '<node onion>: left .onion: ended at https://dashboard.<domain>/'.

The canonical sibling of a source keeps its mapping as before; a further sibling is fanned out only when the target is served in that sibling's network. A dropped onion source has no vhost and the default server answers it with 404 inside the onion instead of redirecting to clearnet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_network_redirects.py

@@ -10,6 +10,8 @@ PRIMARY = default_domain_primary()
 ONION = "abcdefghijklmnopqrstuvwxyz234567abcdefghijklmnopqrstuvw.onion"
 SIBLINGS = {
     f"css.{PRIMARY}": [f"css.{PRIMARY}", f"css.{ONION}"],
+    f"cdn.{PRIMARY}": [f"cdn.{PRIMARY}", f"cdn.{ONION}"],
+    f"apex.{PRIMARY}": [f"apex.{PRIMARY}", f"apex.{ONION}"],
     ONION: [],
 }
 
@@ -40,6 +42,15 @@ class TestNetworkRedirects(unittest.TestCase):
             ],
         )
 
+    def test_a_sibling_whose_network_the_target_does_not_reach_is_dropped(self):
+        target = f"dashboard.{PRIMARY}"
+        self.assertEqual(
+            self._run([{"source": f"apex.{PRIMARY}", "target": target}]),
+            [{"source": f"apex.{PRIMARY}", "target": target}],
+            "an onion sibling redirecting to a clearnet-only target would send "
+            "a Tor visitor off the onion",
+        )
+
     def test_a_source_without_siblings_is_kept(self):
         mappings = [
             {"source": PRIMARY, "target": f"home.{PRIMARY}"},