First PR in a new stacked chain that will extract the net/URL validation helpers out of miles_agent_server.py into an agent_server/net.py module. Tests-first, so the subsequent mechanical-move PRs are safe.

What

New tests/unit/test_miles_agent_server_net.py (37 tests) giving thorough coverage to the host/URL helpers that were previously almost untested (only _normalize_session_server_instance_id had 2 tests in the existing suite):

• _normalize_host — IPv4/IPv6 compression, hostname lowercasing, empty/scoped/invalid rejection
• _format_host_port — IPv4, bracketed IPv6, hostname
• _parse_session_server_id — valid host:port, IPv6, and the scheme/path/missing-port rejections
• _normalize_session_server_instance_id — safe value, empty/space rejection, 128-char boundary
• _parse_url_origin — http/https default ports, explicit port, unsupported-scheme/missing-host/userinfo rejection
• _get_url_origin_id — composition + IPv6
• _resolve_host_ips (async) — IP-set extraction + gaierror → ValueError
• _hosts_overlap (async) — identical-host short-circuit, overlapping vs disjoint IP sets
• _validate_session_server_id (async) — success, port-mismatch, host-mismatch

Notes

• Additive only — no production code touched.
• Async tests patch _resolve_host_ips / _hosts_overlap at the module level; when the helpers move to agent_server/net.py in the follow-up PRs, those patch targets get repointed (patch-where-used).

Tests

• 37 passed for the new file; full tests/unit suite green (2854 passed, 1 skipped); ruff clean.