Feature/delta team/epic r04 (#7)

## Summary

epic r04 - begin refactor

## Change Type

- [x] Cowork feature
- [ ] Bug fix
- [ ] Core AI contribution
- [ ] Test / hardening
- [ ] Performance
- [ ] Documentation

## Related Work

Cowork Task:

Core Repo: http://34.143.229.138/gitea-admin/fsg-ai-core-assets

Core AI Issue:

Core Task:

Related PR:

## Scope

What is intentionally included?

What is intentionally NOT included?

## Validation

- [ ] Unit tests
- [ ] Integration tests
- [ ] Manual verification
- [ ] Regression check

Commands / evidence:

## Security Impact

Permission / credential / network / customer data impact:

## Compatibility

- [ ] No breaking change
- [ ] Breaking change documented

## Reviewer Notes

Anything Cowork reviewers should pay attention to.

---------

Co-authored-by: Anh Tran Nguyen Minh <anhtnm1@fpt.com>
Co-authored-by: Huong Le Thi Thien <huongltt35@fpt.com>
Co-authored-by: Nam Pham Dinh Thanh <nampdt@fpt.com>
Co-authored-by: Vu Dam Tuan <vudt15@fpt.com>
Co-authored-by: Hiep Ha Van <hiephv3@fpt.com>
Co-authored-by: Lam Hoang Van <lamhv7@fpt.com>
Reviewed-on: #7
Co-authored-by: Duy Le Huu <duylh19@fpt.com>

core/tls_trust.py

@@ -53,15 +53,22 @@ def looks_like_cert_trust_error(exc: BaseException) -> bool:
 
 
 def _host_port(url: str) -> tuple[str, int]:
+    """Cặp (host, port) rút từ URL; không có port thì mặc định 443."""
     parsed = urlparse(url)
     return parsed.hostname or "", parsed.port or 443
 
 
 def _slug(host: str) -> str:
+    """Tên file an toàn suy từ host."""
     return re.sub(r"[^a-zA-Z0-9.-]", "_", host) or "host"
 
 
 def trusted_cert_path(url: str) -> Path:
+    """Đường dẫn file PEM ghim chứng chỉ cho một host.
+
+    Mỗi host một file: gateway nội bộ dùng chứng chỉ tự ký, ghim đúng chứng chỉ
+    đã thấy lần đầu (trust on first use) thay vì tắt kiểm chứng chỉ.
+    """
     host, _port = _host_port(url)
     return TRUST_DIR / f"{_slug(host)}.pem"