backend: a bare * in subdomain_expansions means every subdomain

An expansion list of labels guesses which subdomains exist; a '*' entry
makes the guess unnecessary. parse_expansions now reports (labels, wildcard,
rejected) instead of silently keeping junk, expand_entry keeps the base
domain plus the configured labels and leaves '*.base' as a pattern when the
wildcard is on, and the policy grows the 'allowed' masks the desktop
resolver needs to serve exceptions.

backend/app/settings_schema.py

@@ -178,7 +178,9 @@ class BlockerSettings(BaseModel):
 
     `youtube.com` blocks the site (plus `www.` and `m.`); `*.youtube.com` blocks
     its subdomains too, expanded with `subdomain_expansions` because a hosts file
-    has no wildcards of its own.
+    has no wildcards of its own. Put `*` in that list and `*.youtube.com` means
+    every subdomain — the desktop app answers those at DNS level, the phone
+    matches them in the URL bar.
     """
 
     allowed_domains: list[str] = Field(default_factory=list)
@@ -187,7 +189,13 @@ class BlockerSettings(BaseModel):
     subdomain_expansions: list[str] = Field(
         default_factory=lambda: ["www", "m", "mobile", "app", "web", "i", "old", "new"]
     )
-    """What `*.example.com` turns into. Add the subdomains you actually visit."""
+    """What `*.example.com` turns into. Add the subdomains you actually visit.
+
+    A bare `*` means *every* subdomain instead: the hosts file still only gets the
+    labels listed here, while the rest is caught by the phone's URL-bar matcher and
+    by the desktop app's local resolver stub. Anything else that is not a DNS label
+    is ignored and reported as `invalid_expansions`.
+    """
 
     blocked_apps: list[str] = Field(default_factory=list)
     """Process names or masks: `steam`, `*discord*`, `telegram-*`."""