chore(router): address the hosted router by hostname, TLS verification on

router.allaigate.com now resolves and serves a valid certificate, so the
hosted routing API no longer has to be reached by bare IP with certificate
verification switched off. Make https://router.allaigate.com the default
[router].url with verify_tls = true.

Existing configs still pointing at 138.226.222.209 (with or without a scheme
or a trailing slash) are moved to the hostname on load and have verification
restored, then saved: it is the same machine, and this is the difference
between a verified connection and a blind one. A self-hosted router URL is
left untouched.

README, docs/ROUTER.md (both languages), config/gateway.example.toml and
bench/accuracy.py follow.

Verified live: the migration rewrites a legacy config on startup, admin
health reports the hostname reachable over verified TLS (389 ms), and real
requests route through it - "math"/medium 0.416 and "translation"/low 0.268
with route_source=router.

bench/accuracy.py

@@ -4,12 +4,12 @@ heuristic (what you get without a semantic classifier, e.g. with LiteLLM/Portkey
 
     CORTIQ_ROUTER_KEY=cortiq_... python3 bench/accuracy.py
 
-Env: CORTIQ_ROUTER_KEY (required), ROUTER_URL (default https://138.226.222.209),
+Env: CORTIQ_ROUTER_KEY (required), ROUTER_URL (default https://router.allaigate.com),
      TAXONOMY (default data-assistant).
 """
 import json, os, ssl, sys, urllib.request
 
-ROUTER_URL = os.environ.get("ROUTER_URL", "https://138.226.222.209").rstrip("/")
+ROUTER_URL = os.environ.get("ROUTER_URL", "https://router.allaigate.com").rstrip("/")
 TAXONOMY = os.environ.get("TAXONOMY", "data-assistant")
 KEY = os.environ.get("CORTIQ_ROUTER_KEY", "")
 CTX = ssl._create_unverified_context()