feat(routing): per-task rules on top of complexity tiers; hosted router is the default

The router has always returned two signals — task label and complexity tier —
but only the tier picked models. [routing.tasks] adds `label → ordered models`:
a matching rule's models lead the candidate chain and the tier chain follows as
fallback, so pinning translations to a local model never weakens failover.
Requests whose chain was headed by a task rule report
route_source "router+task-rule".

The Routing page grows a per-task editor built from the account's LIVE
taxonomy (GET /v1/taxonomies via the new /admin/api/routing/labels proxy;
built-in label set when the router is unreachable), with localized task names,
each task's share of 7-day traffic, "by complexity (no rule)" as the explicit
empty state, and custom labels for other taxonomies. Deleting a model scrubs
it from task rules like it always did from tiers.

Also fixes the default config pointing at a placeholder localhost:8080 router
with a nonexistent taxonomy — a fresh install now targets the hosted allaigate
router (IP endpoint, verify_tls off, data-assistant, 12 s oracle timeout) and
degrades gracefully until a key is set. Verified end-to-end against the live
router: translation → task-rule model, math → tier path.

16 new strings in all 7 languages.

web/css/styles.css

@@ -585,6 +585,12 @@ body.modal-open { overflow: hidden; }
 /* Featured gallery: the list grows as new models are published, so give it more
    room than the search grid before it starts scrolling. */
 .featured-section .hf-grid { max-height: min(62vh, 760px); }
+/* Routing: per-task rule rows */
+.taskrow { align-items: flex-start; }
+.taskname { min-width: 190px; line-height: 1.35; }
+.taskname .mono { font-size: 10.5px; opacity: .75; }
+.chips-empty { padding: 4px 0; font-style: italic; }
+
 /* Shell notices (open admin warning, update available) */
 .notice {
   display: flex; align-items: center; gap: 8px;