feat(server): add Gov cloud region (#7730)

Adds the Gov cloud region across three layers. Enum: Gov = 2 in
Bit.Core.Enums.CloudRegion. Config: Gov entry in
CloudRegionConfig.All (bitwarden-gov.com domain, API, identity,
vault, and SSO-callback URLs). Because Constants.BitwardenCloudDomains
and BitwardenMobileSsoCallbackUris derive from CloudRegionConfig.All,
and ServiceCollectionExtensions iterates All for Swagger server
registration, Gov flows into HTTPS-redirect allowlists, mobile SSO
callback validation, and OpenAPI server definitions without further
code changes. Tests: first coverage for BitwardenCloudDomains and
BitwardenMobileSsoCallbackUris membership and for
GetCloudVaultSubscriptionUrl URL resolution, parametrized over
US/EU/Gov.

Server-side foundation for the Bitwarden Gov cloud environment,
independent of any feature flag. Stacked on PM-38015's consolidation
work; adding Gov required only one enum value and one
CloudRegionConfig.All entry.

Refs: PM-38016

Author: addisonbeck

src/Core/Enums/CloudRegion.cs

@@ -8,4 +8,6 @@ public enum CloudRegion
     US = 0,
     [Display(Name = "EU")]
     EU = 1,
+    [Display(Name = "Gov")]
+    Gov = 2,
 }

src/Core/Settings/CloudRegionConfig.cs

@@ -53,6 +53,13 @@ private CloudRegionConfig(
             "https://identity.bitwarden.eu",
             "https://vault.bitwarden.eu",
             "https://bitwarden.eu/sso-callback"),
+        new(
+            CloudRegion.Gov,
+            "bitwarden-gov.com",
+            "https://api.bitwarden-gov.com",
+            "https://identity.bitwarden-gov.com",
+            "https://vault.bitwarden-gov.com",
+            "https://bitwarden-gov.com/sso-callback"),
     ];
 
     public static CloudRegionConfig FindByDomain(string domain) =>

test/Core.Test/ConstantsTests.cs

@@ -0,0 +1,24 @@
+using Xunit;
+
+namespace Bit.Core.Test;
+
+public class ConstantsTests
+{
+    [Theory]
+    [InlineData("bitwarden.com")]
+    [InlineData("bitwarden.eu")]
+    [InlineData("bitwarden-gov.com")]
+    public void BitwardenCloudDomains_ContainsAllProductionDomains(string domain)
+    {
+        Assert.Contains(domain, Constants.BitwardenCloudDomains);
+    }
+
+    [Theory]
+    [InlineData("https://bitwarden.com/sso-callback")]
+    [InlineData("https://bitwarden.eu/sso-callback")]
+    [InlineData("https://bitwarden-gov.com/sso-callback")]
+    public void BitwardenMobileSsoCallbackUris_ContainsAllRegionCallbacks(string uri)
+    {
+        Assert.Contains(uri, Constants.BitwardenMobileSsoCallbackUris);
+    }
+}

test/Core.Test/Services/HandlebarsMailServiceTests.cs

@@ -364,4 +364,20 @@ public async Task SendIndividualUserWelcomeEmailAsync_HandlesVariousEmailFormats
         await _mailDeliveryService.Received(1).SendEmailAsync(Arg.Is<MailMessage>(m =>
             m.ToEmails.Contains(email)));
     }
+
+    [Theory]
+    [InlineData("us", "https://vault.bitwarden.com")]
+    [InlineData("eu", "https://vault.bitwarden.eu")]
+    [InlineData("gov", "https://vault.bitwarden-gov.com")]
+    public void GetCloudVaultSubscriptionUrl_ResolvesPerRegion(string cloudRegion, string expectedVaultBase)
+    {
+        // Arrange
+        _globalSettings.BaseServiceUri.CloudRegion = cloudRegion;
+
+        // Act
+        var result = _sut.GetCloudVaultSubscriptionUrl(Guid.NewGuid());
+
+        // Assert
+        Assert.StartsWith(expectedVaultBase, result);
+    }
 }