Add a Network > Ports page: agent-reported ports plus manual openings

Summarizes every server's agent-reported listening ports in one
cross-server table (grouped by protocol+port, addresses merged,
loopback-only flagged) - previously this only existed per-server on
each server's own detail page.

Adds a second table for ports this app has no way to see on its own:
manually-recorded openings on a router, edge firewall, or cloud
security group, each with a label, external port/protocol, an optional
link to a tracked server (with its own internal port when NAT changes
it) or a freeform destination, a free-text source, and a comment.
Viewer-readable; adding/editing/deleting needs operator or admin.

The agent-port grouping logic (dedupe by protocol+port, detect
loopback-only sockets) was shared with the existing per-server Ports
card via a new agentPorts.ts service instead of duplicating it.

Verified with a real HTTP-level test: a genuine Express app with the
actual routers, a scratch SQLite DB, and forged admin/viewer sessions,
covering grouping correctness, the server-name join, input validation,
and role enforcement - the real dev DB was confirmed untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -268,6 +268,20 @@ host (`ss`), which catches services listening on localhost only — a scan from
 elsewhere can't see those, so they'd otherwise look free. Re-run the agent
 install one-liner on a host to pick that up.
 
+**Network → Ports** is the cross-server counterpart: one page listing every
+port every agent currently reports as listening, across all servers at once
+(protocol, address, process, last report time), each linking back to its
+server. Below that, a separate, manually-maintained table is for the ports
+this app can't see on its own — a router's port forward, an edge firewall
+rule, a cloud security group — the same reason people keep a spreadsheet of
+"what did I open and why." Each entry has a label, the external port/protocol,
+an optional link to a tracked server (plus its own internal port, when NAT
+changes it) or a freeform destination, a free-text "source" (which
+router/firewall/service it's actually configured on — this app doesn't talk
+to any firewall, so it can't manage or verify the rule, only record it), and
+a comment. Viewers can see both tables; adding, editing, or deleting a manual
+entry needs operator or admin.
+
 The app is installable as a PWA — "Install app" / "Add to Home Screen" from the
 browser gives it its own icon and a standalone window on phone or desktop. This
 needs the site to be served over HTTPS (browsers only offer install on secure