Read an empty APP_PORT as unset, so NaN never reaches Vite

[Bartok9]

What this changes

Empty APP_PORT= / SERVER_PORT= (compose blank, leftover .env) used to become NaN for Vite, so the UI bound an ephemeral port and /api proxied to http://localhost:. Both now mean the documented defaults via listenPort; non-numeric values refuse to start.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Each process still reads its own env; empty still means 3010/3001.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No. Same Vite ports, now parsed strictly.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. N/A — process start, not a gateway call.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

listenPort already covered empty/typo cases in shared/listen-port.test.ts. Added app/vite-listen-port.test.ts for the 3010/3001 fallbacks. Local bun was not on this nightly PATH; CI will run the suite.

[davidmckayv]

Deep-reviewed against live code (correctness, governance, no vendor/secret/scale issues). Composed build+tests green. CHANGELOG/format rebase on CI-validated substance.