Expose a port the agent's local server listens on [write]

Create-or-get: the port gets a stable origin https://app-<id>.agentsky.dev/ relayed to the pod (HTTP and WebSocket) while the pod runs; calling again returns the same record, and a visibility in the body replaces the stored one in place. port is 1024–65535 and never the pod's own (400 invalid_request). A private port (the default) admits a browser only through an entry link from POST …/grants; a public port admits anyone with the address. A parked pod answers a paused page and is never woken by a visit. An archived session answers 400 session_archived.