Short answer: it cannot be done.
I don't have an exact list of all the issues that exist, but based on my experience, there's just too much to change to support it.
At the root of the problem is that the path of a web request cannot be empty. Browsers hide the leading slash on bare domains, but it's there. Both the javascript and PHP need that shash to exist. On bare domain it's conveniently hidden by the browser itself while keeping it available to javascript and PHP, so everything is fine.
Flarum's implementation of subfolder is just that, it supports adding a new folder in front but all of the remaining logic is exactly the same and requires the leading /.
The slash on a subdomain however is not hidden by the browser, and hiding it client-side requires extra code in both javascript and PHP. PHP is the easiest because you can transparently proxy the URL, but in the frontend the Mithril router relies on the path, and it doesn't like when the root of the app isn't /. There can also be a lot of issues with extensions and the base property of a page, the cookie path, etc.