Please address the comments from this code review:

## Overall Comments
- In `resolve_external_urls`, the local-development fallback hardcodes `:3001`, `:4000/ui`, and `:8080`; consider deriving these from the existing `LITELLM_URL`, `LLAMA_SERVER_URL`, and Langfuse configuration constants to avoid future port/config drift.
- The default `ROUTING_DOMAIN` in `resolve_external_urls` and the `PUBLIC_BASE_URL` default in `start-stack.sh` both encode `x570.vendeuvre.lan`/`vendeuvre.lan`; consolidating these into a single shared configuration source would reduce the chance of subtle misalignment across components.
- The new production deployment checklist in `.agents/AGENTS.md` hardcodes the `boy` user and specific host paths; consider parameterizing these (e.g., with placeholders or variables) so that the instructions are less tied to one machine/user and easier to adapt safely.

## Individual Comments

### Comment 1
<location path="router/main.py" line_range="3093-3094" />
<code_context>
+    domain = os.getenv("ROUTING_DOMAIN") or "vendeuvre.lan"
+    if not isinstance(external_host, str) or not re.match(r"^[a-zA-Z0-9.-]+$", external_host):
+        external_host = "localhost"
+    if not isinstance(external_netloc, str) or not re.match(r"^[a-zA-Z0-9.-]+(?::\d+)?$", external_netloc):
+        external_netloc = "localhost"
+
+    # Enforce strict domain validation to prevent loose substring match bypasses (e.g., attacker-vendeuvre.lan)
</code_context>
<issue_to_address>
**suggestion:** The netloc validation regex excludes valid forms like IPv6 literals and hostnames with non-standard characters, which may be too strict.

The `external_netloc` regex only accepts `[a-zA-Z0-9.-]` plus optional `:port`, which excludes valid cases like IPv6 literals (`[::1]:4000`), IDN/punycode hostnames, or reverse-proxy-modified netlocs. In those cases, silently forcing `localhost` can mask misconfigurations and change behavior unexpectedly. If the intent is mainly to filter clearly bad inputs, consider either relaxing validation (e.g., use `urlparse` and trust its hostname parsing) or explicitly logging/rejecting invalid values instead of defaulting to `localhost`.

Suggested implementation:

```python
import os
import re
import logging
from urllib.parse import urlparse

logger = logging.getLogger(__name__)

```

```python
        external_netloc = parsed.netloc or "localhost"
        external_scheme = parsed.scheme if parsed.scheme in ("http", "https") else "https"
    else:
        external_host = request.base_url.hostname or "localhost"
        external_netloc = request.base_url.netloc or "localhost"
        external_scheme = request.url.scheme if request.url.scheme in ("http", "https") else "https"

    domain = os.getenv("ROUTING_DOMAIN") or "vendeuvre.lan"

    # Basic sanity-check on external_host, but don't over-restrict valid hostnames;
    # fall back to the request base URL rather than silently forcing localhost.
    if not isinstance(external_host, str) or not re.match(r"^[a-zA-Z0-9.-]+$", external_host):
        logger.warning(
            "Unexpected external_host %r, falling back to request.base_url.hostname (%r)",
            external_host,
            request.base_url.hostname,
        )
        external_host = request.base_url.hostname or "localhost"

    # Relax external_netloc validation: use urlparse so IPv6 literals, IDN/punycode,
    # and reverse-proxy-modified netlocs are supported. Log and fall back instead of
    # silently forcing localhost when invalid.
    if isinstance(external_netloc, str):
        parsed_netloc = urlparse(f"{external_scheme}://{external_netloc}")
        if not parsed_netloc.hostname:
            logger.warning(
                "Invalid external_netloc %r, falling back to request.base_url.netloc (%r)",
                external_netloc,
                request.base_url.netloc,
            )
            external_netloc = request.base_url.netloc or "localhost"
    else:
        logger.warning(
            "Non-string external_netloc %r, falling back to request.base_url.netloc (%r)",
            external_netloc,
            request.base_url.netloc,
        )
        external_netloc = request.base_url.netloc or "localhost"

```

- Ensure that `router/main.py` does not already define a `logger` with a different convention. If it does, reuse the existing logger instead of creating a new one.
- If your codebase uses a centralized logging configuration or helper (e.g., `from .logging import logger`), adapt the `logger` usage accordingly rather than importing `logging` and creating a new logger in this file.
- If the actual import section in `router/main.py` does not exactly match `import os` / `import re`, adjust the first SEARCH/REPLACE block to fit the existing imports while still adding `import logging` and `from urllib.parse import urlparse` plus the `logger = logging.getLogger(__name__)` line.
</issue_to_address>