feat: dedicated portal listener and stable presence reads

[St4NNi]

The portal now runs on its own listener per node instead of sharing the REST port behind a Host header check: the REST root always redirects to the Swagger UI, unknown API paths return plain 404 instead of SPA HTML, and the portal serves the SPA at its own origin. Stale realm presence reads now wait for the in-flight refresh before answering, which removes the periodic flapping of healthy peers to "configured" in realm views. The local cluster deploy prints a reworked summary with labeled per node URLs and test credentials. Enabling the portal now requires PORTAL_SOCKET_ADDRESS and API_PUBLIC_URL, the portal CSP derives the API origin automatically, and CORS_ALLOWED_ORIGINS must include the portal origin.

Changes:

• Serve the portal from a dedicated listener with its own socket address, wired into the ingress shutdown phase
• Redirect the REST root, /api/v1, and /swagger to the Swagger UI unconditionally
• Serve an absolute apiBaseUrl in portal-config.json derived from API_PUBLIC_URL
• Derive the portal CSP connect-src and img-src from the configured API origin, admitting explicit http origins with a startup warning
• Expose Retry-After to cross-origin callers
• Await the single-flight presence refresh within the caller deadline before answering stale, releasing the refresh slot through a drop guard
• Allocate a per node portal port in the cluster deploy script and verify portal-config.json on it, only when a portal is deployed
• Rework the deploy summary with labeled per node URLs and a test credentials section, and improve the just recipe docs
• Update the CI cluster checks to probe the portal listener and the new summary format

[codecov]

Codecov Report

❌ Patch coverage is 85.89109% with 57 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.49%. Comparing base (9d80b31) to head (97051ba).

Files with missing lines	Patch %	Lines
aruna/src/main.rs	33.87%	41 Missing ⚠️
api/src/portal.rs	82.25%	11 Missing ⚠️
aruna/src/shutdown.rs	75.00%	3 Missing ⚠️
aruna/src/config.rs	97.61%	1 Missing ⚠️
aruna/src/portal.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #457      +/-   ##
==========================================
- Coverage   87.53%   87.49%   -0.04%     
==========================================
  Files         400      400              
  Lines      265327   265628     +301     
==========================================
+ Hits       232246   232405     +159     
- Misses      33081    33223     +142     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.