chore: move prod container port from 8000 to 8080

- Dockerfile: EXPOSE + HEALTHCHECK + uvicorn --port all shift to 8080.
- docker-compose.yml: host:container mapping shifts to 8080:8080.
- run_dev.sh: new host-dev launcher; default PORT=8080 to stay in
  sync with the prod shape.

Caddy upstream config on the VM needs to follow to 127.0.0.1:8080.
PUBLIC_BASE_URL in the production .env should reflect the public
hostname (unaffected by the internal port change).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -87,14 +87,14 @@ RUN groupadd -g 10001 app \
 
 USER app
 
-EXPOSE 8000
+EXPOSE 8080
 
 # Phase 6 healthcheck: hits /healthz over the loopback with stdlib
 # urllib so we don't have to install curl/wget in the runtime image.
 # Intervals tuned for a small VM: probe every 30s, give a fresh
 # container 10s to finish startup before the first probe counts.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-    CMD python -c "import urllib.request,sys; urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2); sys.exit(0)" || exit 1
+    CMD python -c "import urllib.request,sys; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2); sys.exit(0)" || exit 1
 
 # Run Uvicorn directly. --proxy-headers + --forwarded-allow-ips make
 # Starlette's ProxyHeadersMiddleware trust X-Forwarded-* only from the
@@ -102,6 +102,6 @@ HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
 # image; local hot-reload is a dev concern and runs outside Docker.
 CMD ["uvicorn", "app.main:app", \
      "--host", "0.0.0.0", \
-     "--port", "8000", \
+     "--port", "8080", \
      "--proxy-headers", \
      "--forwarded-allow-ips", "127.0.0.1"]