feat(web,host/windows): move the web console off :3000 to :47992

Port 3000 collides with half the dev-server ecosystem; 47992 sits next
to the mgmt API (47990) in the punktfunk port family. Updates the run
scripts, systemd/scheduled-task units, Dockerfile, Windows firewall
rule + installer, packaging, and every doc that referenced :3000.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

design/ci.md

@@ -40,7 +40,7 @@ the GPU/compositor stack of the box it runs on). What is:
 
 | Image | Source | Notes |
 |---|---|---|
-| `git.unom.io/unom/punktfunk-web` | `web/Dockerfile` (repo-root context — orval needs `api/openapi.json`) | Nitro `bun` bundle; `PORT` (3000) and `PUNKTFUNK_MGMT_URL` env at runtime |
+| `git.unom.io/unom/punktfunk-web` | `web/Dockerfile` (repo-root context — orval needs `api/openapi.json`) | Nitro `bun` bundle; `PORT` (47992) and `PUNKTFUNK_MGMT_URL` env at runtime |
 | `git.unom.io/unom/punktfunk-docs` | `docs-site/Dockerfile` | This site; `PORT` (3000) |
 | `git.unom.io/unom/punktfunk-rust-ci` | `ci/rust-ci.Dockerfile` | Ubuntu 26.04 + FFmpeg 8/PipeWire/GL/GBM dev libs + a libcuda **link stub** (driver userspace, no kernel module) + pinned rustup — the container `ci.yml`'s Rust job runs in |
 

design/windows-build-and-packaging.md

@@ -157,8 +157,8 @@ and stays. Each subcommand is best-effort (a hiccup warns, never aborts the inst
   (pf-vdisplay) or `pnputil /add-driver` per-inf (gamepads - the host SwDeviceCreate's the devnodes).
   A driver hiccup never aborts the install (the host degrades to a physical display).
 - **Web console (`web setup`):** write the ACL'd `web-password`, register the `PunktfunkWeb` task (boot,
-  SYSTEM, restart-on-failure -> `bun` on `:3000`, via a generated UTF-16 Task Scheduler XML), open TCP
-  3000, start it. Upgrade-safe: stop + reap any old console (by the `:3000` listener owner, runtime-
+  SYSTEM, restart-on-failure -> `bun` on `:47992`, via a generated UTF-16 Task Scheduler XML), open TCP
+  47992, start it. Upgrade-safe: stop + reap any old console (by the `:47992` listener owner, runtime-
   agnostic - identified by the wildcard foreign address, so the localized state word is never parsed)
   before re-registering so the new one can bind.
 
@@ -172,7 +172,7 @@ secrets, an ephemeral self-signed cert is generated and its `.cer` published nex
 The console is a TanStack Start / Nitro SSR app (`web/`). `vite.config.ts` sets `noExternals: true`, so
 `bun run build` emits a **self-contained `.output`** (~75 files, deps bundled + tree-shaken, no
 `node_modules`/`.npmrc`). The installer ships that `.output` + a portable `bun.exe`; the `PunktfunkWeb`
-task runs `bun .output/server/index.mjs` on `:3000`, auto-wired to the host's loopback mgmt API via
+task runs `bun .output/server/index.mjs` on `:47992`, auto-wired to the host's loopback mgmt API via
 `web-run.cmd` (sources `%ProgramData%\punktfunk\mgmt-token` + `web-password`). No node, no node_modules
 forest. (`build-web.ps1` is the dev-box rebuild-and-restart helper.)