feat(web,host/windows): move the web console off :3000 to :47992

Port 3000 collides with half the dev-server ecosystem; 47992 sits next
to the mgmt API (47990) in the punktfunk port family. Updates the run
scripts, systemd/scheduled-task units, Dockerfile, Windows firewall
rule + installer, packaging, and every doc that referenced :3000.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/punktfunk-web.service

@@ -1,4 +1,4 @@
-# punktfunk management web console — systemd USER unit (Nitro SSR on bun, port 3000, HTTPS).
+# punktfunk management web console — systemd USER unit (Nitro SSR on bun, port 47992, HTTPS).
 #
 # Installed by the punktfunk-web .deb to /usr/lib/systemd/user/. AUTO-WIRED — no env editing:
 # it sources the host's mgmt token + the generated login password, serves HTTPS (HTTP/1.1 over TLS)
@@ -21,7 +21,7 @@ EnvironmentFile=%h/.config/punktfunk/mgmt-token
 EnvironmentFile=-%h/.config/punktfunk/web-password
 Environment=PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990
 Environment=NODE_TLS_REJECT_UNAUTHORIZED=0
-Environment=PORT=3000
+Environment=PORT=47992
 Environment=HOST=0.0.0.0
 # Serve HTTPS (HTTP/1.1 over TLS) with the host's own identity cert; mark the
 # session cookie Secure. The host's `serve` writes these PEMs; if absent at start the unit fails and

scripts/steamdeck/README.md

@@ -47,7 +47,7 @@ Note: unlike a bare `serve` (native-only by default), the Deck install enables `
 default so stock Moonlight clients work out of the box; `--no-gamestream` turns that surface off.
 
 Env overrides: `PUNKTFUNK_SRC` (source dir, default `~/punktfunk`), `PUNKTFUNK_BOX` (container name,
-default `pf2`), `PUNKTFUNK_MGMT_PORT` (47990), `PUNKTFUNK_WEB_PORT` (3000).
+default `pf2`), `PUNKTFUNK_MGMT_PORT` (47990), `PUNKTFUNK_WEB_PORT` (47992).
 
 ## What gets installed
 

scripts/steamdeck/install.sh

@@ -29,7 +29,7 @@ SRC="${PUNKTFUNK_SRC:-$HOME/punktfunk}"
 BOX="${PUNKTFUNK_BOX:-pf2}"
 BOX_IMAGE="${PUNKTFUNK_BOX_IMAGE:-docker.io/library/debian:trixie}"
 MGMT_PORT="${PUNKTFUNK_MGMT_PORT:-47990}"
-WEB_PORT="${PUNKTFUNK_WEB_PORT:-3000}"
+WEB_PORT="${PUNKTFUNK_WEB_PORT:-47992}"
 OPEN=0
 WITH_WEB=1
 GAMESTREAM=1 # Moonlight/GameStream compat on by default; --no-gamestream for a secure native-only host

scripts/web-init.sh

@@ -15,5 +15,5 @@ if [ ! -s "$PWFILE" ]; then
     (umask 077; printf 'PUNKTFUNK_UI_PASSWORD=%s\n' "$PW" > "$PWFILE")
     chmod 600 "$PWFILE" 2>/dev/null || true
     echo "punktfunk web console login password generated: $PW"
-    echo "(stored in $PWFILE — open http://<host-ip>:3000 and log in)"
+    echo "(stored in $PWFILE — open http://<host-ip>:47992 and log in)"
 fi

scripts/windows/README.md

@@ -38,9 +38,9 @@ On an **installed** host (the `setup.exe`) the console is set up automatically
 The installer bundles the built (self-contained, no-`node_modules`) `.output` server + a portable
 bun and runs `punktfunk-host.exe web setup`, which registers the **`PunktfunkWeb`** scheduled task
 (at boot, as SYSTEM, restart-on-failure) running `{app}\web\web-run.cmd` →
-`bun …\.output\server\index.mjs` on `:3000`, opens inbound TCP 3000, and writes the login password to
+`bun …\.output\server\index.mjs` on `:47992`, opens inbound TCP 47992, and writes the login password to
 `%ProgramData%\punktfunk\web-password` (ACL'd to Administrators + SYSTEM). The mgmt bearer token it
-proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `http://<host-ip>:3000`
+proxies with is the host's own `%ProgramData%\punktfunk\mgmt-token`. Browse `http://<host-ip>:47992`
 and log in with the password the installer shows on its final page. To change it, edit
 `web-password` and re-run the task: `schtasks /run /tn PunktfunkWeb`.
 

scripts/windows/build-web.ps1

@@ -5,7 +5,7 @@
 
   bun is both the build tool AND the runtime: vite.config's Nitro noExternals bundles every dep
   into the self-contained .output (no node_modules, nothing for bun to fail to resolve), so the
-  PunktfunkWeb task runs web\web-run.cmd -> bun .output\server\index.mjs on :3000.
+  PunktfunkWeb task runs web\web-run.cmd -> bun .output\server\index.mjs on :47992.
 #>
 $ErrorActionPreference = 'Stop'
 $repo = Split-Path (Split-Path $PSScriptRoot)
@@ -30,6 +30,6 @@ Start-Sleep 2
 & schtasks /run /tn $task | Out-Null
 Start-Sleep 5
 try {
-  $r = Invoke-WebRequest 'http://127.0.0.1:3000/login' -UseBasicParsing -TimeoutSec 10
+  $r = Invoke-WebRequest 'http://127.0.0.1:47992/login' -UseBasicParsing -TimeoutSec 10
   Write-Host "DONE - web /login -> HTTP $($r.StatusCode)"
 } catch { Write-Warning "web restarted but /login check failed: $($_.Exception.Message)" }

scripts/windows/web-run.cmd

@@ -34,7 +34,7 @@ for /f "usebackq tokens=1* delims==" %%A in ("%TOKENFILE%") do set "%%A=%%B"
 if exist "%PWFILE%" for /f "usebackq tokens=1* delims==" %%A in ("%PWFILE%") do set "%%A=%%B"
 
 rem Fixed deployment wiring (the Windows analogue of scripts/punktfunk-web.service).
-set "PORT=3000"
+set "PORT=47992"
 set "HOST=0.0.0.0"
 set "PUNKTFUNK_MGMT_URL=https://127.0.0.1:47990"
 set "NODE_TLS_REJECT_UNAUTHORIZED=0"