fix: move newsfeed-api off 8081 to 22672 (conflict-unlikely port)

8081 is the alt-HTTP port — one of the crowded defaults every proxy/dev server
grabs — so it's collision-prone on a shared host. Move to 22672, a registered-
range port in the sparse 20000s band, derived deterministically from the
service name and recorded in architecture port-allocations.md.

Updated everywhere the number appears: api bind config + default, firewalld
service XML, nginx upstream, vite dev proxy, deploy workflow API_PORT,
infra-setup (SELinux semanage label), and docs.

Operator note: re-run script/infra-setup.sh on slartibartfast to relabel the
SELinux port (22672) and ship the updated firewalld XML before the next deploy
restarts the api on the new port.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

script/infra-setup.sh

@@ -9,7 +9,7 @@
 #   * a scoped /etc/sudoers.d/newsfeed_gitea_ci drop-in (visudo-verified)
 # and per role:
 #   * API host (slartibartfast): the `newsfeed` service account, /etc/newsfeed +
-#     /var/lib/newsfeed, SELinux port label for 8081, firewalld service
+#     /var/lib/newsfeed, SELinux port label for 22672, firewalld service
 #   * WEB host (oolon): /var/www/newsfeed webroot, the internal `newsfeed.internal` TLS
 #     cert (lair provisioner) + step@newsfeed renewal, and the nginx vhost
 #
@@ -19,7 +19,7 @@ set -euo pipefail
 # --- infra truth (edit here if the topology changes) -------------------------------
 API_HOST="slartibartfast.kosherinata.internal"   # newsfeed-api + newsfeed-worker
 WEB_HOST="oolon.kosherinata.internal"            # nginx: SPA + API reverse proxy
-API_PORT="8081"
+API_PORT="22672"
 CERT_NAME="newsfeed"                             # dot-free; serves ${CERT_NAME}.internal
 PUBLIC_FQDN="rob.fyi"                             # WAN name (Let's Encrypt); "" to skip
 CERT_EMAIL="ops@rob.fyi"                          # certbot registration email