Pre-authorise DSTL domain and add allow-list helpers

[aboldguess]

Summary

• normalise allowed-source handling in the config, defaulting to contracts.mod.uk and exposing a parsed allow list to the server
• extend the run and Raspberry Pi helper scripts with switches for appending allow-list domains and document the workflow in the README and help page
• clarify the admin help hint so operators know DSTL is pre-approved and how to add further hosts

Testing

• npm test

---

https://chatgpt.com/codex/tasks/task_e_68dfb42368f483289a61fe0182a736aa