chore(router): address the hosted router by hostname, TLS verification on

router.allaigate.com now resolves and serves a valid certificate, so the
hosted routing API no longer has to be reached by bare IP with certificate
verification switched off. Make https://router.allaigate.com the default
[router].url with verify_tls = true.

Existing configs still pointing at 138.226.222.209 (with or without a scheme
or a trailing slash) are moved to the hostname on load and have verification
restored, then saved: it is the same machine, and this is the difference
between a verified connection and a blind one. A self-hosted router URL is
left untouched.

README, docs/ROUTER.md (both languages), config/gateway.example.toml and
bench/accuracy.py follow.

Verified live: the migration rewrites a legacy config on startup, admin
health reports the hostname reachable over verified TLS (389 ms), and real
requests route through it - "math"/medium 0.416 and "translation"/low 0.268
with route_source=router.

src/config.rs

@@ -318,6 +318,34 @@ fn default_verify_tls() -> bool {
     true
 }
 
+/// The hosted allaigate routing API.
+pub const DEFAULT_ROUTER_URL: &str = "https://router.allaigate.com";
+
+/// The bare IP the hosted router used to be addressed by. It served a
+/// certificate for `router.allaigate.com`, so every config pointing at it had to
+/// turn TLS verification off. The hostname now resolves, so configs written
+/// before it existed are moved over on load — the endpoint is the same machine,
+/// and this is the difference between a verified connection and a blind one.
+const LEGACY_ROUTER_HOSTS: &[&str] = &[
+    "https://138.226.222.209",
+    "http://138.226.222.209",
+    "138.226.222.209",
+];
+
+impl RouterCfg {
+    /// Point a legacy IP-addressed router config at the hostname and restore TLS
+    /// verification. Returns true when something changed.
+    fn migrate_hosted_endpoint(&mut self) -> bool {
+        let url = self.url.trim().trim_end_matches('/');
+        if !LEGACY_ROUTER_HOSTS.contains(&url) {
+            return false;
+        }
+        self.url = DEFAULT_ROUTER_URL.to_string();
+        self.verify_tls = true;
+        true
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct RouteCfg {
     #[serde(default = "default_text_strategy")]
@@ -882,9 +910,9 @@ impl Default for Config {
             // models and the console asks for one; nothing breaks.
             router: RouterCfg {
                 enabled: true,
-                url: "https://138.226.222.209".to_string(),
+                url: DEFAULT_ROUTER_URL.to_string(),
                 timeout_ms: 15_000, // hard prompts escalate to an oracle (~10 s)
-                verify_tls: false,  // the hosted endpoint is IP-bound
+                verify_tls: true,
                 api_key_env: Some("CORTIQ_ROUTER_KEY".to_string()),
                 taxonomy_id: Some("data-assistant".to_string()),
             },
@@ -954,7 +982,14 @@ impl Config {
     pub fn load(path: &str) -> anyhow::Result<Self> {
         let raw = std::fs::read_to_string(path)
             .map_err(|e| anyhow::anyhow!("cannot read config {path}: {e}"))?;
-        let cfg: Config = toml::from_str(&raw)?;
+        let mut cfg: Config = toml::from_str(&raw)?;
+        if cfg.router.migrate_hosted_endpoint() {
+            tracing::info!(
+                url = DEFAULT_ROUTER_URL,
+                "router endpoint moved from the bare IP to the hostname; TLS verification is on"
+            );
+            let _ = cfg.save(path);
+        }
         cfg.validate()?;
         Ok(cfg)
     }
@@ -1091,6 +1126,39 @@ impl Config {
 mod tests {
     use super::*;
 
+    #[test]
+    fn the_hosted_router_defaults_to_the_hostname_with_tls_on() {
+        let cfg = Config::default();
+        assert_eq!(cfg.router.url, "https://router.allaigate.com");
+        assert!(cfg.router.verify_tls);
+    }
+
+    #[test]
+    fn a_legacy_ip_router_config_moves_to_the_hostname() {
+        for legacy in [
+            "https://138.226.222.209",
+            "https://138.226.222.209/",
+            "138.226.222.209",
+        ] {
+            let mut r = Config::default().router;
+            r.url = legacy.to_string();
+            r.verify_tls = false;
+            assert!(r.migrate_hosted_endpoint(), "{legacy} must migrate");
+            assert_eq!(r.url, DEFAULT_ROUTER_URL);
+            assert!(r.verify_tls, "TLS verification must be restored");
+        }
+    }
+
+    #[test]
+    fn a_self_hosted_router_url_is_left_alone() {
+        let mut r = Config::default().router;
+        r.url = "http://127.0.0.1:8081".to_string();
+        r.verify_tls = false;
+        assert!(!r.migrate_hosted_endpoint());
+        assert_eq!(r.url, "http://127.0.0.1:8081");
+        assert!(!r.verify_tls);
+    }
+
     const SAMPLE: &str = r#"
 listen = "0.0.0.0:9000"