feat(service-ports): remove hardcoded ports from docker-compose, make all service ports configurable

All host port bindings in docker-compose.yml now use \${VAR:-default} substitution,
driven by the .env file generated by ip_utils.write_env_file(). Changing a port in
Settings triggers a per-container pending-restart banner so only the affected container
is restarted on Apply.

- ip_utils: add PORT_DEFAULTS, PORT_ENV_VAR_NAMES, PORT_TO_CONTAINERS; extend
  write_env_file() to accept optional ports dict and write all port env vars
- docker-compose: convert all hardcoded port bindings to \${VAR:-default} form
- app.py: add _collect_service_ports helper; detect port changes in update_config,
  write updated .env and call _set_pending_restart with specific container list;
  update _set_pending_restart to merge/accumulate pending state with containers list;
  update apply_pending_config to use --no-deps <service> for targeted restarts
- config_manager: add submission_port, webmail_port to email schema; add manager_port
  to files schema
- Settings.jsx: make all email/files ports editable, add submission_port, webmail_port,
  manager_port fields; update stale identity note
- tests: 8 new tests for PORT_DEFAULTS, PORT_ENV_VAR_NAMES, and port override in write_env_file

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -194,14 +194,15 @@ def write_cell_config(cell_name: str, domain: str, port: int):
 
 
 def write_compose_env(ip_range: str):
-    """Generate .env at project root so docker-compose picks up correct container IPs."""
+    """Generate .env at project root so docker-compose picks up correct IPs and ports."""
     sys.path.insert(0, os.path.join(ROOT, 'api'))
     import ip_utils
     env_path = os.path.join(ROOT, '.env')
+    # Pass no custom ports — ip_utils will use PORT_DEFAULTS for all port vars
     if ip_utils.write_env_file(ip_range, env_path):
         print(f'[CREATED] .env  (ip_range={ip_range})')
     else:
-        print(f'[WARN]    Could not write .env — containers will use built-in default IPs')
+        print(f'[WARN]    Could not write .env — containers will use built-in default IPs/ports')
 
 
 def main():