Add heybrand.ai page-subdomain and page-apex templates

[emabellor]

Description

Two new templates for heybrand (providerId heybrand.ai), a personal-brand website builder. Customers connect their own domain to a page hosted on our platform:

• heybrand.ai.page-subdomain.json ‚Äî serve a page on a subdomain the customer picks (hostRequired): one CNAME to our platform target plus the two TLS/ownership validation TXT records.
• heybrand.ai.page-apex.json ‚Äî serve a page on a root domain: A/AAAA to our proxy, an ACME delegation CNAME for certificate issuance/renewal at the apex, and a www CNAME (which serves the page) with its two validation TXT records.

Both templates use the signed synchronous flow (syncPubKeyDomain: heybrand.ai; keys are published at dckey1.heybrand.ai).

Type of change

• New template
• Bug fix (non-breaking change which fixes an issue in the template)
• New feature (non-breaking change which adds functionality to the template)
• Breaking change (fix or feature that would cause existing template behavior to be not backward compatible)

How Has This Been Tested?

• Template functionality checked using Online Editor
• Template file name follows the pattern <providerId>.<serviceId>.json
• resource URL provided with logoUrl is actually served by a webserver ‚Äî N/A, logoUrl is not set

Checklist of common problems

• syncPubKeyDomain is set ‚Äî publicly resolvable at dckey1.heybrand.ai (TXT, p=1/p=2 split, RS256/x509)
• warnPhishing is not set alongside syncPubKeyDomain
• syncRedirectDomain is set (the synchronous flow uses redirect_uri)
• no TXT record contains SPF content
• txtConflictMatchingMode is set on every TXT record that must be unique per label (All on all validation TXTs)
• no variable is used as a bare full record value unless necessary ‚Äî the TXT data values (%ssltxt%, %ownertxt%, %wwwssltxt%, %wwwownertxt%) are exact validation tokens issued by the CA / hosting platform (ACME DNS-01 challenge values and ownership-verification tokens); a fixed prefix would make validation fail. Misuse is mitigated by the signed sync flow: apply URLs must be signed with our key (syncPubKeyDomain), so third parties cannot populate these variables.
• no bare variable is used as the full host label ‚Äî all host values are fixed (@, www, _acme-challenge, _cf-custom-hostname, _acme-challenge.www, _cf-custom-hostname.www)
• no variable is used in the host field to create a subdomain ‚Äî page-subdomain uses hostRequired + the standard host parameter with records relative to it
• %host% does not appear explicitly in any host attribute
• essential is set to OnApply on the one-time validation TXT records (certificate renewals do not need them; users may clean them up)

Online Editor test results

Editor test link(s):

• Test heybrand.ai/page-subdomain ederabello.xyz/pages
• Test heybrand.ai/page-apex ederabello.xyz/@
• Test heybrand.ai/page-apex ederabello.xyz/site