Allow underscores in allowlist_hosts and referer_blocklist host names

The shared entry check refused host names with an underscore, though
both lists can match them. The check's comment now says that what it
refuses can never match a host name that resolves.

Model: opus-5-5

internal/config/config.go

@@ -742,14 +742,15 @@ func (c *Config) validateConcurrencyLimits() error {
 	return nil
 }
 
-// hostNamePattern matches a host name: letters, digits, hyphens and dots,
-// optionally after one leading dot.
-var hostNamePattern = regexp.MustCompile(`^\.?[A-Za-z0-9-][A-Za-z0-9.-]*$`)
+// hostNamePattern matches a host name: letters, digits, hyphens, underscores
+// and dots, optionally after one leading dot.
+var hostNamePattern = regexp.MustCompile(`^\.?[A-Za-z0-9_-][A-Za-z0-9_.-]*$`)
 
 // validateHostPattern checks that an entry of the named key, allowlist_hosts
 // or referer_blocklist, is an IP address or a host name, the host name
 // optionally with one leading dot for suffix matching. Anything else, such as
-// a URL, a port or a "*." wildcard, can never match a host, so it is refused.
+// a URL, a port or a "*." wildcard, can never match a host name that resolves,
+// so it is refused.
 // So is "." alone: the allowlist matcher would match it against any host
 // written with a trailing dot, which in allowlist_hosts disables URL signing.
 func validateHostPattern(key, host string) error {