Changes

paas: port conflict detection for create/auto-assign + health-gate port guard on deploy

Every app owns PORT and PORT+1000 (health gate). 'paas create --port' now refuses a port
that another app uses as PORT or gate port, the panel port, or anything already bound on
the host, and auto-assignment skips those too; 'paas deploy' refuses to gate on a port
another process answers on. Found when kredible-sw was created on logship-landing's port
and the gate health-checked the wrong app.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>