fix: move newsfeed-api off 8081 to 22672 (conflict-unlikely port)

8081 is the alt-HTTP port — one of the crowded defaults every proxy/dev server
grabs — so it's collision-prone on a shared host. Move to 22672, a registered-
range port in the sparse 20000s band, derived deterministically from the
service name and recorded in architecture port-allocations.md.

Updated everywhere the number appears: api bind config + default, firewalld
service XML, nginx upstream, vite dev proxy, deploy workflow API_PORT,
infra-setup (SELinux semanage label), and docs.

Operator note: re-run script/infra-setup.sh on slartibartfast to relabel the
SELinux port (22672) and ship the updated firewalld XML before the next deploy
restarts the api on the new port.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

readme.md

@@ -65,9 +65,9 @@ cd web && pnpm install && pnpm build
 ## Run locally
 
 ```sh
-# 1. API (creates ./data/newsfeed.db, binds 127.0.0.1:8081)
+# 1. API (creates ./data/newsfeed.db, binds 127.0.0.1:22672)
 NEWSFEED_DATABASE_PATH=./data/newsfeed.db \
-NEWSFEED_BIND=127.0.0.1:8081 \
+NEWSFEED_BIND=127.0.0.1:22672 \
 NEWSFEED_COOKIE_SECURE=false \
   cargo run -p newsfeed-api -- --config /nonexistent
 
@@ -75,7 +75,7 @@ NEWSFEED_COOKIE_SECURE=false \
 NEWSFEED_DATABASE_PATH=./data/newsfeed.db \
   cargo run -p newsfeed-worker -- --config /nonexistent
 
-# 3. Frontend dev server (proxies /v1 and /health to :8081)
+# 3. Frontend dev server (proxies /v1 and /health to :22672)
 cd web && pnpm dev
 ```
 
@@ -86,19 +86,19 @@ non-existent `--config` path just uses defaults + env, which is convenient for d
 
 ```sh
 # register + login (cookie jar)
-curl -c cj -X POST localhost:8081/v1/auth/register -H content-type:application/json \
+curl -c cj -X POST localhost:22672/v1/auth/register -H content-type:application/json \
   -d '{"username":"me","email":"me@example.com","password":"hunter2hunter2"}'
-curl -c cj -X POST localhost:8081/v1/auth/login -H content-type:application/json \
+curl -c cj -X POST localhost:22672/v1/auth/login -H content-type:application/json \
   -d '{"identifier":"me","password":"hunter2hunter2"}'
 
 # weight an interest, mint an ingest token
-curl -b cj -X PUT  localhost:8081/v1/interests -H content-type:application/json -d '{"label":"rust","weight":0.9}'
-TOKEN=$(curl -b cj -X POST localhost:8081/v1/tokens -H content-type:application/json -d '{"name":"agent"}' | jq -r .secret)
+curl -b cj -X PUT  localhost:22672/v1/interests -H content-type:application/json -d '{"label":"rust","weight":0.9}'
+TOKEN=$(curl -b cj -X POST localhost:22672/v1/tokens -H content-type:application/json -d '{"name":"agent"}' | jq -r .secret)
 
 # an agent pushes a candidate; read the ranked feed
-curl -X POST localhost:8081/v1/ingest/candidates -H "authorization: Bearer $TOKEN" \
+curl -X POST localhost:22672/v1/ingest/candidates -H "authorization: Bearer $TOKEN" \
   -H content-type:application/json -d '{"external_id":"a1","title":"Rust 2.0 released"}'
-curl -b cj localhost:8081/v1/feed
+curl -b cj localhost:22672/v1/feed
 ```
 
 ## API surface (`/v1`)