Ferrite and Fabric staging

This box terminates TLS for two name trees, each with a wildcard so applications can launch under their own subdomain:

• ferrite.staging.aws.igent.ai and *.ferrite.staging.aws.igent.ai
• fabric.staging.aws.igent.ai and *.fabric.staging.aws.igent.ai

Routing is in place ahead of the services. A hostname whose upstream is not yet running answers with an explanatory page rather than a bare gateway error.