chore(router): address the hosted router by hostname, TLS verification on

router.allaigate.com now resolves and serves a valid certificate, so the
hosted routing API no longer has to be reached by bare IP with certificate
verification switched off. Make https://router.allaigate.com the default
[router].url with verify_tls = true.

Existing configs still pointing at 138.226.222.209 (with or without a scheme
or a trailing slash) are moved to the hostname on load and have verification
restored, then saved: it is the same machine, and this is the difference
between a verified connection and a blind one. A self-hosted router URL is
left untouched.

README, docs/ROUTER.md (both languages), config/gateway.example.toml and
bench/accuracy.py follow.

Verified live: the migration rewrites a legacy config on startup, admin
health reports the hostname reachable over verified TLS (389 ms), and real
requests route through it - "math"/medium 0.416 and "translation"/low 0.268
with route_source=router.

config/gateway.example.toml

@@ -8,13 +8,13 @@
 listen = "0.0.0.0:9000"
 
 # --- connection to cortiq-router (decides task type / complexity) -----------
-# Hosted allaigate router: url = "https://138.226.222.209", verify_tls = false
+# Hosted allaigate router: url = "https://router.allaigate.com" (the default)
 # (cert is bound to an IP), taxonomy_id = "data-assistant", a cortiq_… key in
 # CORTIQ_ROUTER_KEY.
 # NOTE: on hard prompts the router escalates to an oracle LLM (~10 s) — for the
 # hosted router set timeout_ms = 12000+, otherwise the gateway degrades to default.
 [router]
-url         = "https://138.226.222.209"   # hosted allaigate router (or your own cortiq-router URL)
+url         = "https://router.allaigate.com"  # hosted allaigate router (or your own cortiq-router URL)
 api_key_env = "CORTIQ_ROUTER_KEY"   # name of the env var holding the router key
 timeout_ms  = 12000                  # hard prompts escalate to an oracle (~10 s)
 taxonomy_id = "data-assistant"       # the hosted router's task taxonomy