fix(web): guard the app-origin port and the trusted-origin grant

Copilot review round 3 on #2100.

- MCP_APP_ORIGIN_PORT could equal CLIENT_PORT or MCP_SANDBOX_PORT. The
  app-origin listener starts BEFORE the web server binds, so that is not a
  race it loses — it wins the port and the Inspector dies with EADDRINUSE.
  `CLIENT_PORT=6278` was a valid config before this feature existed. It now
  resolves to a dynamic port with a warning: of the three listeners this is
  the only one that can move, and refusing to boot would cost the user the
  whole Inspector over a feature they may not be using.
- The proxy's same-origin refusal covered only its own origin. An app served
  from the INSPECTOR's origin is no safer: same-origin with the top document
  means direct access to window.top, its DOM and its storage, and the
  cross-origin frame in between buys nothing. Both trusted origins are now
  refused before allow-same-origin is granted.
- Replaced the `as unknown as number` on `server.address()` with a real
  narrowing of the string/null members of its return type.
- MCP_APP_ORIGIN_PORT added to the v1→v2 migration guide's env table, its
  Docker recipe, and a troubleshooting entry for the symptom this actually
  produces (the app renders, but its own backend rejects `Origin: null`).
- clients/web/README.md now states which failure is outside the fallback
  guarantee — a published document the browser cannot reach — and why there
  is no honest signal to fall back on. Docs and code no longer disagree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/server/app-origin-controller.ts

@@ -298,12 +298,15 @@ export function createAppOriginController(
 
         server.listen(port, host, () => {
           const addr = server!.address();
-          const actualPort =
-            typeof addr === "object" && addr !== null && "port" in addr
-              ? addr.port
-              : /* v8 ignore next -- unreachable for a TCP listen; `address()`
-                   returns AddressInfo. */
-                (addr as unknown as number);
+          /* v8 ignore next 4 -- unreachable for a TCP listen: inside the
+             `listening` callback `address()` returns an AddressInfo. The guard
+             is a narrowing for the string (pipe/socket) and null members of the
+             return type, not a case this listener can produce. */
+          if (typeof addr !== "object" || addr === null) {
+            settle({ port: 0, url: "" });
+            return;
+          }
+          const actualPort = addr.port;
           // A wildcard bind isn't reachable as `http://0.0.0.0:PORT`, but it
           // does serve loopback — advertise `localhost` there, and otherwise
           // the same canonical host the origin allow-list emits.