Make the app's port configurable via DEVPLACE_PORT

make dev/prod hardcoded uvicorn to port 10500 with no way to override it,
so config.PORT (and everything derived from it - INTERNAL_BASE_URL,
Devii's own base URL defaults) stayed 10500 regardless of what port the
process actually bound to. DEVPLACE_PORT now drives all of it, defaulting
to 10500. Docker's existing PORT var (the externally published port via
nginx) is unrelated and untouched; its app container pins DEVPLACE_PORT
to 10500 explicitly so a bare-metal .env value can never leak in and
desync it from the Dockerfile's fixed internal bind port.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CLAUDE.md

@@ -116,6 +116,7 @@ Tests run on port 10501 with a tempfile SQLite DB and a dedicated `DEVPLACE_DATA
 | Var | Default | Purpose |
 |-----|---------|---------|
 | `DEVPLACE_DATABASE_URL` | `sqlite:///<repo>/data/devplace.db` | Override DB path (tests use this) |
+| `DEVPLACE_PORT` | `10500` | Port the app itself binds to bare-metal (`make dev`/`make prod`, wired to uvicorn's `--port`; tests use their own `DEVPLACE_TEST_PORT`, default `10501`). Also `config.PORT`'s source, so `DEVPLACE_INTERNAL_BASE_URL`'s default and Devii's self-dial URL (`DEFAULT_BASE_URL`/`INSTANCE_ORIGIN_DEFAULT`) follow it automatically. The Docker app container pins it to `10500` in `docker-compose.yml` regardless of `.env` - Docker's externally reachable port is the unrelated `PORT` var (nginx's host mapping), never this one. |
 | `SECRET_KEY` | hardcoded fallback | Session signing |
 | `DEVPLACE_DISABLE_SERVICES` | unset | When `1`, NewsService and other background services skip start (set by test conftest) |
 | `PLAYWRIGHT_HEADLESS` | `1` in tests | Toggle headed mode |