CI: the test ports 55432, 58080 and 58081 lie in Linux's ephemeral port range, so a compose start can fail with 'address already in use' #46

E2E Tests (self-hosted) failed on #45 (run 40055658400) at docker compose -f docker-compose.test.yml up -d --wait postgres keycloak on a fresh GitHub-hosted ubuntu-24.04 runner:

failed to bind host port for 0.0.0.0:58080:172.18.0.2:8080/tcp: address already in use

The defaults of docker-compose.test.yml, TEST_POSTGRES_PORT 55432, TEST_KEYCLOAK_PORT 58080 and TEST_KEYCLOAK_PROXIED_PORT 58081, all lie in Linux's default ephemeral range 32768 to 60999 (/proc/sys/net/ipv4/ip_local_port_range), so any outgoing connection of the runner, such as an image pull, can hold one of them as its local port when compose binds it. The job passed on a rerun.

Expected: the test ports cannot collide with the ephemeral range: defaults below 32768 (and away from common services), or a reservation through net.ipv4.ip_local_reserved_ports in the CI jobs before the containers start. The ports are named in CLAUDE.md, .env.example, the Keycloak test realm's redirect URIs and the test helpers, so the change updates every one of them; scripts/ci/compose-projects.test.ts can pin the rule.