Triage: fix(portal): allow single-label container hostnames in private network validation

[time-attack]

Tracking the change proposed in #188 (by @elf-mouse).

We're moving this from a code PR to a tracked issue under CONTRIBUTING.md: feature ideas belong in adrs/ as a short human-written note and bugs as an issue, and we implement the underlying code from our side. Capturing the original proposal here so it isn't lost.

Original PR: #188
Reported by: @elf-mouse

---

When running under Docker Compose, internal upstream services (such as the authentication broker http://auth:8080) use bare single-label hostnames without dots (e.g. auth).

The previous isPrivateNetworkUrl check rejected any non-IP host missing a domain extension or .local suffix, causing portal boot checks to fail with a misconfiguration error.

This commit updates isPrivateNetworkUrl to accept single-label hostnames (!host.includes(.)) as valid private network hosts.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

If we ship a fix or feature from this, credit @elf-mouse as co-author.