feat(new-server): detect host-port conflicts outside mcontrol-managed rows

[AbstractNucleus]

What: Port-collision validation only checks against other mcontrol-managed rows. A non-mcontrol service on the same host port is invisible to the check.

Why: Operators get a confusing failure at container start instead of a clear validation error on the form.

Approach: Before accepting a server's host port, check whether anything is currently bound to it on the host (e.g. probe with a quick TCP connect, or shell out to ss / docker port). Reject the form if so with a clear error.

[AbstractNucleus]

This was generated by AI during triage.

Routed to ready-for-human — picking the host-port probe method matters:

• TCP connect to 127.0.0.1:port from inside the app container — works only when host-network or socket-shared.
• docker port enumeration — sees mcontrol-managed and other-Docker containers but not raw host services.
• Shell out to ss/netstat — needs host PID namespace or running on the host directly.

Right choice depends on the deployment shape. Human call first.