Add a Network > Ports page: agent-reported ports plus manual openings

Summarizes every server's agent-reported listening ports in one
cross-server table (grouped by protocol+port, addresses merged,
loopback-only flagged) - previously this only existed per-server on
each server's own detail page.

Adds a second table for ports this app has no way to see on its own:
manually-recorded openings on a router, edge firewall, or cloud
security group, each with a label, external port/protocol, an optional
link to a tracked server (with its own internal port when NAT changes
it) or a freeform destination, a free-text source, and a comment.
Viewer-readable; adding/editing/deleting needs operator or admin.

The agent-port grouping logic (dedupe by protocol+port, detect
loopback-only sockets) was shared with the existing per-server Ports
card via a new agentPorts.ts service instead of duplicating it.

Verified with a real HTTP-level test: a genuine Express app with the
actual routers, a scratch SQLite DB, and forged admin/viewer sessions,
covering grouping correctness, the server-name join, input validation,
and role enforcement - the real dev DB was confirmed untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ROLES.md

@@ -30,6 +30,7 @@ page's own top-level link.
 | DNS | `/dns` | ✅ | ✅ | ✅ |
 | Domains | `/domains` | ✅ | ✅ | ✅ |
 | IP Addresses | `/ipam` | ✅ | ✅ | ✅ |
+| Ports | `/ports` | ✅ | ✅ | ✅ |
 | Consistency | `/consistency` | ✅ | ✅ | ✅ |
 | **Automation** | | | | |
 | Semaphore | `/semaphore` | ✅ | ✅ | ✅ |
@@ -71,6 +72,8 @@ even further, to admin only:
   linking/unlinking it to a Proxmox guest just need operator.
 - **Tags**: creating, renaming, recoloring, or deleting a tag is
   admin-only (applying an existing tag to a server needs operator).
+- **Ports**: everyone can see both the agent-reported and manual tables;
+  adding, editing, or deleting a manual port opening needs operator.
 - Everything under **Settings** (notification channels, badge colors,
   display prefs, log retention, backup/restore) is admin-only, matching
   the page itself being admin-only.