fix(web): move the app origin off 6276, bound the publish route

Copilot review round 2 on #2100, plus a collision the review did not find.

The default app-origin port was 6276 — which is already
RUNNER_OAUTH_CALLBACK_DEFAULT_PORT, the CLI/TUI loopback OAuth callback.
That port is fixed precisely so an OAuth app can pre-register
http://127.0.0.1:6276/oauth/callback, which makes it the one listener here
that cannot move when something takes it first. A running --web would hold
it and break a later --cli/--tui OAuth flow at its registered redirect URI,
and docs/mcp-app-review.md has those two running side by side. This
listener has a documented dynamic fallback, so this listener yields: the
default is now 6278 (6277 skipped — v1's retired proxy port, which the
migration guide tells people to stop forwarding). A test asserts the two
defaults stay distinct.

Review comments:

- POST /api/app-document now applies hono's bodyLimit BEFORE parsing. The
  8MiB check ran after c.req.json() had buffered and parsed the whole
  request, and bounded only `html` — so bulk in `csp`, or in keys the route
  never reads, was fully materialized before the 413.
- `csp` is validated as an HTTP header value and length-bounded. The
  controller hands it to res.writeHead() verbatim, where Node throws
  ERR_INVALID_CHAR synchronously — inside the handler for a later,
  unrelated request, outside this route's error handling.
- The app-origin port now propagates everywhere the other two do: the CLI
  --print-handoff port-forward command (and its test), the Dockerfile's ENV
  and EXPOSE, and the remote-review SSH recipe in docs/mcp-app-review.md.
  Without it an app declaring _meta.ui.domain is unreachable through every
  documented remote workflow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/components/elements/AppRenderer/createAppBridgeFactory.test.ts

@@ -498,7 +498,7 @@ describe("createAppBridgeFactory", () => {
       );
       const publishAppDocument = vi
         .fn<(doc: { html: string; csp?: string }) => Promise<string | null>>()
-        .mockResolvedValue("http://localhost:6276/app-document/abc");
+        .mockResolvedValue("http://localhost:6278/app-document/abc");
       const factory = createAppBridgeFactory({
         getClient: () => fakeClient,
         readResource,
@@ -517,7 +517,7 @@ describe("createAppBridgeFactory", () => {
 
       const call = bridgeInstances[0].sendSandboxResourceReady.mock
         .calls[0][0] as { html: string; src?: string };
-      expect(call.src).toBe("http://localhost:6276/app-document/abc");
+      expect(call.src).toBe("http://localhost:6278/app-document/abc");
       // `html` still rides along: a proxy that ignores `src` renders the app
       // rather than a blank frame.
       expect(call.html).toBe(published.html);
@@ -530,7 +530,7 @@ describe("createAppBridgeFactory", () => {
     ])("does not take the dedicated path for %s", async (_label, domain) => {
       const publishAppDocument = vi
         .fn<(doc: { html: string; csp?: string }) => Promise<string | null>>()
-        .mockResolvedValue("http://localhost:6276/app-document/abc");
+        .mockResolvedValue("http://localhost:6278/app-document/abc");
       const factory = createAppBridgeFactory({
         getClient: () => fakeClient,
         readResource: vi
@@ -550,7 +550,7 @@ describe("createAppBridgeFactory", () => {
     it("never publishes a resource that declares no domain", async () => {
       const publishAppDocument = vi
         .fn<(doc: { html: string; csp?: string }) => Promise<string | null>>()
-        .mockResolvedValue("http://localhost:6276/app-document/abc");
+        .mockResolvedValue("http://localhost:6278/app-document/abc");
       const factory = createAppBridgeFactory({
         getClient: () => fakeClient,
         readResource: vi.fn().mockResolvedValue(uiResource("<h1>x</h1>")),