[SaladDay]

Why

The managed gateway published host ports 80 and 443 even before any domain was configured, so a host whose port 80 was taken (for example by nginx) could not install at all, although HTTPS is optional and set up later in Web. Domain setup only discovered port or DNS problems after a 180 s certificate verification timeout, with one lumped message.

What

• ingress_config.published(config, candidate=None) always publishes ports.web, and adds 80/443 only when public_url is set or a domain candidate is being verified. The single listener derivation follows, so:

  • a default install with port 80 taken succeeds;
  • --public-url installs still check 80/443 up front;
  • oac apply checks them when HTTPS turns on.

• Domain setup (ingress.prepare, used by Web and oac domain) runs fast checks before reserving a job, each returning a 409:

  • hostname_unresolved when the hostname has no A/AAAA record;
  • https_ports_unavailable naming the busy port(s).

  The gateway's own ports never count, so a domain change with HTTPS already on passes.

• The attempt recreates the gateway with 80/443 through the common apply path, keeping Core and Web on the applied address until verification succeeds. A failed attempt restores the gateway without 80/443.

• The verification-failure message now names DNS, firewall/NAT and certificate causes.

• Docs: the Ports section of install-options.md owns the fact; install, operations, configuration, the installer README and the printed next steps link to it.

Web shows the new 409s through the existing "not accepted" alert with details. No apps/web change.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}