chore(router): address the hosted router by hostname, TLS verification on

router.allaigate.com now resolves and serves a valid certificate, so the
hosted routing API no longer has to be reached by bare IP with certificate
verification switched off. Make https://router.allaigate.com the default
[router].url with verify_tls = true.

Existing configs still pointing at 138.226.222.209 (with or without a scheme
or a trailing slash) are moved to the hostname on load and have verification
restored, then saved: it is the same machine, and this is the difference
between a verified connection and a blind one. A self-hosted router URL is
left untouched.

README, docs/ROUTER.md (both languages), config/gateway.example.toml and
bench/accuracy.py follow.

Verified live: the migration rewrites a legacy config on startup, admin
health reports the hostname reachable over verified TLS (389 ms), and real
requests route through it - "math"/medium 0.416 and "translation"/low 0.268
with route_source=router.

CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project are documented here.
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.2.47] - 2026-08-21
+
+### Changed
+- **The hosted allaigate router is addressed by hostname:
+  `https://router.allaigate.com`** is now the default `[router].url`, and
+  `verify_tls` defaults to `true`. The endpoint used to be reachable only by bare IP,
+  whose certificate is issued for the hostname — so every hosted setup had to run with
+  certificate verification switched off. It no longer does.
+- **Existing configs are migrated on load.** A `[router].url` still pointing at the old
+  `138.226.222.209` (with or without a scheme or trailing slash) is rewritten to the
+  hostname, `verify_tls` is turned back on, and the file is saved — the endpoint is the
+  same machine, and this is the difference between a verified connection and a blind one.
+  A self-hosted router URL is never touched.
+- README, `docs/ROUTER.md` (both languages), `config/gateway.example.toml` and
+  `bench/accuracy.py` updated to the hostname.
+
 ## [0.2.46] - 2026-08-21
 
 Verified end to end against a real Open WebUI container talking to the gateway.