fix(lookup): keep the clearnet apex redirect on a multi-network node

current_play_redirect_domains gated both apex entries on web-opt-rdr-domains being in lookup('deployment').deployed whenever the host serves Tor. On a multi node that also dropped the clearnet DOMAIN_PRIMARY -> DOMAIN_HOMEPAGE entry for every isolated variant without that role, so the apex had no vhost and answered with a TLS handshake reject; the Matrix federation delegation on the apex depends on that vhost in swarm. A clearnet node, and main, always schedules it.

The clearnet entry is now scheduled whenever the node's resolved NETWORK_MODE serves clearnet, and the deployment gate keeps guarding only the onion-apex entry. A tor-only node keeps the old behaviour, and the operator's production inventory runs no Tor host, so production is unaffected. Tests cover multi without the role (clearnet apex only) and tor-only (no apex).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/unit/python/plugins/lookup/test_current_play_redirect_domains.py

@@ -403,6 +403,25 @@ class CurrentPlayRedirectDomainsLookupTests(unittest.TestCase):
     def test_onion_apex_absent_when_rdr_domains_not_deployed(self):
         lm = self._make_lookup()
         variables = self._onion_variables()
+        with self._patch_lookups(deployed=["web-opt-rdr-www"], current_play_apps={}):
+            result = lm.run(terms=[], variables=variables)[0]
+        self.assertEqual(
+            result,
+            [{"source": DOMAIN, "target": "dashboard.abcdefonion.onion"}],
+        )
+
+    def test_multi_node_keeps_the_clearnet_apex_without_rdr_domains_deployed(self):
+        lm = self._make_lookup()
+        variables = self._onion_variables(
+            NETWORK_MODE="multi", DOMAIN_HOMEPAGE="infinito.nexus"
+        )
+        with self._patch_lookups(deployed=["web-opt-rdr-www"], current_play_apps={}):
+            result = lm.run(terms=[], variables=variables)[0]
+        self.assertEqual(result, [{"source": DOMAIN, "target": "infinito.nexus"}])
+
+    def test_tor_only_node_drops_both_apex_entries_without_rdr_domains_deployed(self):
+        lm = self._make_lookup()
+        variables = self._onion_variables(NETWORK_MODE="tor")
         with self._patch_lookups(deployed=["web-opt-rdr-www"], current_play_apps={}):
             result = lm.run(terms=[], variables=variables)[0]
         self.assertEqual(result, [])