Fixes the regression introduced when jundot#1526 switched from uvicorn.run()
to uvicorn.Config + bind_socket() + Server.run(sockets=[...]): the old
approach silently accepted a list of hosts via asyncio.create_server(),
but bind_socket() calls sock.bind((host, port)) which requires a string.

Changes:
- settings.py: normalise legacy YAML list values (host: [a, b]) to a
  comma-separated string on load so the web UI and server both see a str
- cli.py (serve_command): parse comma-separated hosts, bind one socket
  per address before model preload (preserving the fail-fast guarantee
  from jundot#1526), then pass all sockets to Server.run()
- cli.py (launch_command): pick the first bind address as the connect
  host, normalising wildcards (0.0.0.0, ::) to 127.0.0.1
- utils/network.py: add is_valid_bind_host() which accepts 0.0.0.0 and
  :: unlike is_valid_alias() which rejects unspecified addresses
- admin/routes.py: validate each comma-separated part on save, returning
  a readable 400 before an invalid value can crash the server on restart
- admin/static/js/dashboard.js: extract .msg from Pydantic error objects
  instead of joining raw objects (fixes [object Object] display), two sites
- admin/i18n/{en,zh,ja,ko,zh-TW}.json: add host_multi_hint string and
  drop "(caution)" from host_custom label now that multi-address is valid
- admin/templates/dashboard/_settings.html: show host_multi_hint hint
  below the custom host input when the custom mode is active

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: support comma-separated bind addresses in host setting

Fixes the regression introduced when #1526 switched from uvicorn.run()
to uvicorn.Config + bind_socket() + Server.run(sockets=[...]): the old
approach silently accepted a list of hosts via asyncio.create_server(),
but bind_socket() calls sock.bind((host, port)) which requires a string.

Changes:
- settings.py: normalise legacy YAML list values (host: [a, b]) to a
  comma-separated string on load so the web UI and server both see a str
- cli.py (serve_command): parse comma-separated hosts, bind one socket
  per address before model preload (preserving the fail-fast guarantee
  from #1526), then pass all sockets to Server.run()
- cli.py (launch_command): pick the first bind address as the connect
  host, normalising wildcards (0.0.0.0, ::) to 127.0.0.1
- utils/network.py: add is_valid_bind_host() which accepts 0.0.0.0 and
  :: unlike is_valid_alias() which rejects unspecified addresses
- admin/routes.py: validate each comma-separated part on save, returning
  a readable 400 before an invalid value can crash the server on restart
- admin/static/js/dashboard.js: extract .msg from Pydantic error objects
  instead of joining raw objects (fixes [object Object] display), two sites
- admin/i18n/{en,zh,ja,ko,zh-TW}.json: add host_multi_hint string and
  drop "(caution)" from host_custom label now that multi-address is valid
- admin/templates/dashboard/_settings.html: show host_multi_hint hint
  below the custom host input when the custom mode is active

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* revert: restore "(caution)" label on host_custom in all languages

The caution warning is still valid — manually entering a bind address
can inadvertently expose the server, and supporting multiple addresses
makes that risk more rather than less relevant.

* fix: put host_multi_hint inside right-side flex column, below the input

* fix: reject IP-shaped invalid hosts and handle comma-separated bind hosts

is_valid_bind_host(): add a digit-dot regex guard so strings like
999.999.999.999 that fail ipaddress.ip_address() are not silently
accepted as hostnames (digit-only dotted labels satisfy RFC 1123).

detect_server_aliases(): split the host parameter on commas before
checking for loopback/wildcard addresses, so values like
"127.0.0.1, ::1" no longer drop localhost from the alias list.

Adds focused tests covering valid IPv4/IPv6 (including unspecified
addresses and IPv4-mapped IPv6), valid hostnames, IP-shaped-but-invalid
values of various arity, malformed hostnames, and wrong types.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: tighten hostname validation — reject all-digit last labels in dotted names

is_valid_hostname(): require the rightmost label of any dotted name to
contain at least one letter.  IANA has never delegated a numeric TLD, so
an all-digit last label (e.g. "999" in "999.999.999.999") indicates an
IP-shaped string, not a real hostname.  This mirrors the approach used by
the validators PyPI library (python-validators), whose domain regex ends
with [a-z] to enforce the same constraint.  Single-label names (no dots)
are local hostnames and are exempt from the TLD constraint.

The IP-shaped fast-path guard in is_valid_bind_host() is retained as a
cheap short-circuit, but the root fix is now in is_valid_hostname() so
both is_valid_bind_host() and is_valid_alias() benefit.

Adds is_valid_hostname tests for the new behaviour, and fixes
test_accepts_hostname_with_dashes_instead_of_dots to verify that
single-label names without letters (e.g. "192-168-1-1") are still
accepted.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>