[brianjfox]

Closes #91

What changed

• apps/hub/src/environment.ts: LIVE_APP_PORTS, a range such as 4100-4119, read as liveAppPorts; absent means any free port, as before. Malformed values refuse startup with a clear message.
• apps/hub/src/live-app/proxy.ts: serveWithin takes the first free port of the range, skipping ports the other apps hold and ports something else already holds, and fails with live_app_ports_exhausted when none is left. Without a range it binds port 0 as before.
• apps/hub/src/artifacts/service.ts: when exposing fails, the app is reported as failed with the reason instead of the request failing.
• deploy/compose.yml: publishes the range on loopback beside the hub's port and passes it to the hub.
• .env.hub.example and docs/SELF_HOST.md: document the setting and the one-port-per-open-project limit.
• apps/hub/src/environment.test.ts: covers the parser.

Why

Compose publishes only the hub's port and the two login ports. The proxy's origin for a project's app was the hub's public origin with a random port swapped in, so on 2026-11-02 the preview frame pointed at http://localhost:34141, which the browser could not reach, while the hub inside answered on it. Details in #91.

How it was verified

• tsc --noEmit -p . passes; oxlint --deny-warnings and Prettier pass on the changed files; environment, live-app and artifacts tests pass (12 tests, 1 new).
• docker compose config renders LIVE_APP_PORTS=4100-4119 in the hub's environment and publishes the twenty ports.
• The hub was rebuilt from this branch with the app relay (now on main via test(e2e): replay recorded weather app project end to end in CI #81) on the Compose deployment; see the follow-up note on the PR for what the browser saw.

Replaces #93.

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: ci: deploy/compose.yml

Triage will approve, request review, label.

[linear-code]

CL-11875