Improve external service discovery and tool routing

platform/mcp/compose.yaml

@@ -142,7 +142,7 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.platform-context
-    image: mike-ai/mcp-platform-context:1.0.0
+    image: mike-ai/mcp-platform-context:1.1.0
     container_name: mike-ai-mcp-platform-context
     environment:
       ATHENA_REPO_ROOT: /knowledge/repo
@@ -158,7 +158,9 @@ services:
       - ${PLATFORM_DOCS_DIR:-/opt/mike-ai/stack/docs}:/workspace/docs:rw
       - ${PLATFORM_CONTEXT_RUNTIME_DIR:-/var/lib/mike-ai-platform-context}:/runtime:ro
       - ${PLATFORM_CONTEXT_STATE_DIR:-/data/mike-ai-platform-context}:/state:rw
-    networks: [tools]
+    # The context service has no arbitrary URL input. Its only egress use is a
+    # bounded reachability check of endpoints from config/service-catalog.json.
+    networks: [tools, egress]
     healthcheck:
       test: ["CMD", "python", "-c", "import socket; s=socket.create_connection(('127.0.0.1',8000),2); s.close()"]
       interval: 30s
@@ -224,6 +226,10 @@ services:
       UNRAID_RMCP_DISABLE_HTTP_AUTH: "true"
       UNRAID_NOAUTH: "true"
       UNRAID_RMCP_ALLOWED_HOSTS: "mike-ai-mcp-unraid-official:8000,mike-ai-mcp-unraid-official,localhost:8000,127.0.0.1:8000"
+    # Public DNS cannot resolve the Fritzbox-only name. Preserve the hostname
+    # used by the TLS endpoint while binding it to the verified home-LAN IP.
+    extra_hosts:
+      - "homeserver.fritz.box:192.168.1.2"
     volumes:
       - ${RUNRAID_BINARY:-/usr/local/bin/runraid}:/usr/local/bin/unraid:ro
     entrypoint: ["/usr/local/bin/unraid"]