feat(server): add Gov CloudRegion enum value, bitwarden-gov.com domains, and Gov vault URL

Adds Gov region support across three layers:

1. Enum value: adds Gov=2 to src/Core/Enums/CloudRegion.cs
   (Bit.Core.Enums.CloudRegion). The Setup-layer enum was removed in the
   preceding commit; there is now a single canonical enum in Core.

2. CloudRegionConfig.All: appends Gov entry with bitwarden-gov.com domains
   (API, identity, vault, notifications, icons, events, SSO callback).
   Because BitwardenCloudDomains and BitwardenMobileSsoCallbackUris in
   Constants.cs already derive from CloudRegionConfig.All via LINQ spread,
   Gov is automatically included in both allowlists at no extra cost.

3. Tests:
   - ConstantsTests: BitwardenCloudDomains_ContainsAllProductionDomains and
     BitwardenMobileSsoCallbackUris_ContainsAllRegionCallbacks are parametrized
     over US/EU/Gov to assert domain and SSO-callback presence
   - HandlebarsMailServiceTests: GetCloudVaultSubscriptionUrl_ResolvesPerRegion
     parametrized over us/eu/gov to assert vault URL prefix resolution

Implementation note: the prior coordinator's decision to create a new
Bit.Core.Enums.CloudRegion (rather than keep it in Bit.Setup.Enums) was
correct to avoid a circular project dependency (Core must not reference
Setup). Now that the Setup enum is deleted, adding a new region requires
only a single enum update in src/Core/Enums/CloudRegion.cs.

Refs: PM-35089, PM-35087

Author: addisonbeck

src/Core/Enums/CloudRegion.cs

@@ -8,4 +8,6 @@ public enum CloudRegion
     US = 0,
     [Display(Name = "EU")]
     EU = 1,
+    [Display(Name = "Gov")]
+    Gov = 2,
 }

src/Core/Settings/CloudRegionConfig.cs

@@ -58,6 +58,16 @@ private CloudRegionConfig(
             "https://icons.bitwarden.eu",
             "https://events.bitwarden.eu",
             "https://bitwarden.eu/sso-callback"),
+        new(
+            CloudRegion.Gov,
+            "bitwarden-gov.com",
+            "https://api.bitwarden-gov.com",
+            "https://identity.bitwarden-gov.com",
+            "https://vault.bitwarden-gov.com",
+            "https://notifications.bitwarden-gov.com",
+            "https://icons.bitwarden-gov.com",
+            "https://events.bitwarden-gov.com",
+            "https://bitwarden-gov.com/sso-callback"),
     ];
 
     public static CloudRegionConfig FindByDomain(string domain) =>

test/Core.Test/ConstantsTests.cs

@@ -1,4 +1,4 @@
-using Xunit;
+using Xunit;
 
 namespace Bit.Core.Test;
 
@@ -66,4 +66,22 @@ public void InsideRange_WithInvalidValues_ReturnsFalse(int number)
             Assert.False(result);
         }
     }
+
+    [Theory]
+    [InlineData("bitwarden.com")]
+    [InlineData("bitwarden.eu")]
+    [InlineData("bitwarden-gov.com")]
+    public void BitwardenCloudDomains_ContainsAllProductionDomains(string domain)
+    {
+        Assert.Contains(domain, Constants.BitwardenCloudDomains);
+    }
+
+    [Theory]
+    [InlineData("https://bitwarden.com/sso-callback")]
+    [InlineData("https://bitwarden.eu/sso-callback")]
+    [InlineData("https://bitwarden-gov.com/sso-callback")]
+    public void BitwardenMobileSsoCallbackUris_ContainsAllRegionCallbacks(string uri)
+    {
+        Assert.Contains(uri, Constants.BitwardenMobileSsoCallbackUris);
+    }
 }

test/Core.Test/Services/HandlebarsMailServiceTests.cs

@@ -364,4 +364,20 @@ public async Task SendIndividualUserWelcomeEmailAsync_HandlesVariousEmailFormats
         await _mailDeliveryService.Received(1).SendEmailAsync(Arg.Is<MailMessage>(m =>
             m.ToEmails.Contains(email)));
     }
+
+    [Theory]
+    [InlineData("us", "https://vault.bitwarden.com")]
+    [InlineData("eu", "https://vault.bitwarden.eu")]
+    [InlineData("gov", "https://vault.bitwarden-gov.com")]
+    public void GetCloudVaultSubscriptionUrl_ResolvesPerRegion(string cloudRegion, string expectedVaultBase)
+    {
+        // Arrange
+        _globalSettings.BaseServiceUri.CloudRegion = cloudRegion;
+
+        // Act
+        var result = _sut.GetCloudVaultSubscriptionUrl(Guid.NewGuid());
+
+        // Assert
+        Assert.StartsWith(expectedVaultBase, result);
+    }
 }