Allow underscores in allowlist_hosts and referer_blocklist host names

The shared entry check refused host names with an underscore, though
both lists can match them. The check's comment now says that what it
refuses can never match a host name that resolves.

Model: opus-5-5

TODO.md

@@ -34,15 +34,15 @@ P2: security: per-IP rate limiting on the image routes
 - 2026-10-04 referer blocklist (closes #90): `referer_blocklist`
   (`PIXA_REFERER_BLOCKLIST`) lists hosts, written and matched as for
   `allowlist_hosts` with the same matcher; an entry of either list that is
-  neither a host name (letters, digits, hyphens and dots, with at most one
-  leading dot) nor an IP address, such as one with a port or a `*.` wildcard,
-  aborts startup naming the setting and the entry. Both image routes refuse a
-  request whose `Referer` names a listed host with 403 and a JSON error before
-  the signature, the cache and the upstream fetch, so it fetches nothing and is
-  refused whether or not the image is cached. A request with no `Referer`, or
-  one that does not parse as a URL with a host, is served, so the list is easily
-  got around; `README.md` and `configs/config.example.yml` say so. It does not
-  apply to the login and generator pages.
+  neither a host name (letters, digits, hyphens, underscores and dots, with at
+  most one leading dot) nor an IP address, such as one with a port or a `*.`
+  wildcard, aborts startup naming the setting and the entry. Both image routes
+  refuse a request whose `Referer` names a listed host with 403 and a JSON error
+  before the signature, the cache and the upstream fetch, so it fetches nothing
+  and is refused whether or not the image is cached. A request with no
+  `Referer`, or one that does not parse as a URL with a host, is served, so the
+  list is easily got around; `README.md` and `configs/config.example.yml` say
+  so. It does not apply to the login and generator pages.
 - 2026-10-04 fewer files in the repository root (closes #97):
   `config.example.yml` moved unchanged to `configs/config.example.yml`, and
   `README.md`, the comments in `internal/config/config.go` and the startup error