refactor: publish every host port at 1024 or above, in 23000-23999 for the services bitkit does not dial by a fixed number

[ovitrif]

Refs:

• chore: forward bitkit-docker's new lnd and lnurl host ports in just run docker bitkit-android#1438
• docs: point the lnurl journey at the fixture's new host port bitkit-ios#889
• synonymdev/bitkit-cli#8
• synonymdev/bitkit-mono#6

Description

• Publishes every host port at 1024 or above. darkhttpd published 80, and an SSH remote forward of a port under 1024 needs root on macOS, so a simulator tunnel that forwarded the stack's ports failed as a whole.
• Moves every service that Bitkit does not dial by a fixed number into 23000-23999, mostly at 23000 plus the last three digits of its container port: LNURL server 23000, LDK backup 23003, LNURL-auth 23005, LND gRPC/REST/P2P 23009/23180/23735, LNURL-pay fixture 23010, payment request peers 23012/23013, VSS 23050, darkhttpd 23080, Paykit Server 23101, homeserver admin 23288, homeserver-proxy control 23298, PostgreSQL 23432, Homegate PostgreSQL 23433, Trezor controller/dashboard/MCP/VNC/noVNC 23901/23902/23903/23590/23680. Generic ports such as 3000, 5432 and 8080 no longer collide with a developer's own services.
• Keeps the ports the apps, the Pubky SDK or Bitkit's UI tests dial by number: bitcoind 43782/39388, electrs 60001, Homegate 6288, the Pubky testnet's 6881, 15411, 15412, 6286, 6287, the Trezor Bridge's 21325/21328, and Trezor User Env's controller 9001. A local E2E build keeps working with no app change.
• Container ports stay as they were, so services still reach each other on lnd:8080, darkhttpd:80 and so on.
• LND advertises 127.0.0.1:23735 (--externalip), and the LNURL-pay fixture's LNURL-channel names the same address. A wallet that opens a channel dials the published P2P port.
• payment-requests/prepare reads the peers' host ports from FIXTURE_ISSUER_PORT and RC56_PEER_PORT (default 23012, 23013). pubky-marketplace defaults MARKETPLACE_PAYKIT_PORT to 23101.
• README has a new "Ports" table, and every command in the README and docs uses the new ports.
• No two ports sit a multiple of 1000 apart (up to 8000), so a project that offsets every port by 1000 x n for parallel copies of the stack gets no collision.

Out of Scope

• Consumers of the old host ports move in their own PRs (linked above): bitkit-android just run docker, the bitkit-ios LNURL journey README, bitkit-cli CONTRIBUTING and bitkit-mono's dev wrapper.

Design

N/A — no UI changes.

Preview

N/A — no user-visible changes.

QA Notes

Journeys

N/A

Manual Tests

• Default stack plus lnurl-pay on the new ports → bitcoind, electrs, darkhttpd, LND, LNURL server, LNURL-pay fixture, PostgreSQL, LDK backup and VSS start. 23000/health reports LND synced with URI …@127.0.0.1:23735. LND REST on 23180 answers getinfo with the admin macaroon. The fixture's 23010/health answers. 23080 serves the fee estimates. VSS on 23050 answers getObject without a token with 401. 23003 answers HTTP. TCP connects to 23009, 23432 and 23735 succeed. LND reads its fee URL from darkhttpd:80 inside the network.
• LNURLs → the LNURL server's pay LNURL decodes to http://localhost:23000/pay/…. The fixture's pay and channel LNURLs (asked with Host: 127.0.0.1:23010) decode to http://127.0.0.1:23010/…. The channel request's URI is <lnd pubkey>@127.0.0.1:23735.
• Marketplace and payment request profiles on the new ports → ./pubky-marketplace up waits on Paykit Server through its new default 23101 and reports ready. payment-requests/prepare on its defaults (23012, 23013) runs to the end ("verified": true). After the driver image is rebuilt, seed publishes Paykit Server as http://localhost:23101, and verify reports passed.
• homeserver-proxy and kept Pubky ports → a Pubky client on the host network that dials 6287 signs up through homeserver-proxy: the proxy's control port 23298 lists its LOCK 200, UNLOCK 204 and PUT 201. 6286 answers Pubky Homeserver, 15411 answers HTTP, 23288 answers as the homeserver admin, and 6881 and 15412 accept TCP.

Automated Checks

• ran docker compose config with every profile: every published host port is 1024 or above, and none sit a multiple of 1000 apart up to 8000.

[ovitrif]

Validation: passes at 4c8a818. This PR is stacked on #18; merge #18 first, and then this PR merges into main.

CI: the repository runs no checks on pull requests.

Local checks:

• docker compose config resolves with no profile and with every profile. Every published host port is 1024 or above.
• Spreading every port by 1000 x n for n up to 8, the way parallel copies of the stack publish, gives no collision.

Bring-up: I started the default stack, lnurl-pay, marketplace and payment-requests from 4c8a818 (Docker 29.4, arm64). Every moved port was published on the host, and I called each one from the host:

• LNURL server, 23000
  • /health reports LND synced with URI <pubkey>@127.0.0.1:23735.
  • Its pay LNURL decodes to http://localhost:23000/pay/….
• LND
  • REST on 23180 answers getinfo with the admin macaroon.
  • P2P on 23735 and gRPC on 23009 accept connections.
  • LND still reads its fee estimates from darkhttpd:80 inside the network, and 23080 serves the same file to the host.
• LNURL-pay fixture, 23010: /health answers. Its pay and channel LNURLs (asked with Host: 127.0.0.1:23010) decode to http://127.0.0.1:23010/…, and the channel request's URI is <pubkey>@127.0.0.1:23735.
• VSS 23050, LDK backup 23003, PostgreSQL 23432: getObject without a token answers 401. 23003 answers HTTP. 23432 accepts connections.
• Paykit Server, 23101: ./pubky-marketplace up waits on its new default and reports ready. seed publishes Paykit Server as http://localhost:23101, and verify reports passed.
• Payment request peers, 23012/23013: both answer /health, and payment-requests/prepare on its new defaults runs to the end ("verified": true).
• homeserver-proxy control, 23298, and the kept Pubky ports
  • A Pubky client on the host network that dials 6287 signs up and writes through homeserver-proxy: 23298/requests lists LOCK 200 ×6, UNLOCK 204 ×6 and PUT 201 ×10.
  • 6286 answers Pubky Homeserver.
  • 15411 answers HTTP, and 6881 and 15412 accept connections.
  • 23288 answers as the homeserver admin.

Not started here: trezor-emulator, trezor-user-env-mac, Homegate and lnurl-auth-server (it builds from a sibling repository). Their changes are port numbers and docs only, and docker compose config resolves them.

[ovitrif]

Merged as 3fc1159. The repositories that used the old host ports move in their own PRs:

• chore: forward bitkit-docker's new lnd and lnurl host ports in just run docker bitkit-android#1438: just run docker reverses 23735 and 23000
• docs: point the lnurl journey at the fixture's new host port bitkit-ios#889: LNURL journey README on 23010
• synonymdev/bitkit-cli#8: CONTRIBUTING health check on 23005
• synonymdev/bitkit-mono#6: dev wrapper ports, dev/bitkit-docker pinned to 3fc1159

The trezor tooling docs in open synonymdev/bitkit-android#1170 name the User Env dashboard on 9002; with this stack it is 23902.