fix(core): derive widget domain from registrable host

[AnayGarodia]

Summary

Uses tldts to derive the default widget domain from the server hostname. A server such as capitals.skybridge.tech now emits skybridge.tech, while localhost and other non-registrable hosts safely retain the existing origin fallback.

Closes #359

Testing

• Core package test suite: 335 tests passed across 50 files
• Core Biome formatting check passed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Greptile Summary

This PR derives the default widget domain from the server's registrable hostname. The main changes are:

• Adds tldts for registrable-domain parsing.
• Preserves tenant-specific domains on private suffixes.
• Keeps the existing origin fallback for non-registrable hosts.
• Adds coverage for subdomains, private suffixes, and localhost.

Confidence Score: 5/5

This looks safe to merge.

• Forwarded host lists now select the first hop before URL parsing.
• Private suffix parsing keeps hosted tenants on separate widget domains.
• No blocking issues remain in the changed code.

_{Reviews (2): Last reviewed commit: "fix(core): isolate private-suffix widget..." | Re-trigger Greptile}

[harijoe]

Hi @AnayGarodia, thanks for your contribution!

Since this is your first time contributing to the Skybridge repository, would you mind introducing yourself on our Discord? We'd love to get to know our contributors.