fix(daemon): port probe + bind on both IPv4 and IPv6 loopback (v0.2.9)

v0.2.8 probe only checked 127.0.0.1:PORT. On macOS with AirPlay
Receiver running, the daemon cleanly bound 127.0.0.1:5000 while
AirTunes held ::1:5000 (both listen on *:5000 wildcard with
SO_REUSEADDR, so the probe succeeded). Electron's frontend hits
`http://localhost:5000/` which on macOS resolves `::1` first — and
got 403 Forbidden from AirTunes instead of the daemon's 401/200. UI
stuck on "waiting for backend" forever; daemon itself was fine if
you curl'd 127.0.0.1 directly.

Fix: probe both loopback families per port, pick only one where BOTH
are free; then bind Kestrel to `http://127.0.0.1:PORT` AND
`http://[::1]:PORT` so either resolution hits the daemon.

Verified locally on a machine running AirTunes: lsof shows daemon on
127.0.0.1:5000 + [::1]:5000, ControlCenter on *:5000 (both families),
`curl http://localhost:5000/healthz` → Kestrel (was AirTunes 403).

Author: lukyrys

src/daemon/NKS.WebDevConsole.Daemon/NKS.WebDevConsole.Daemon.csproj

@@ -33,10 +33,10 @@
     <!-- F92: single source of truth for daemon version. Keep in sync with
          src/frontend/package.json on every bump so /api/status and
          /api/system return the real shipped version instead of hardcoded "0.1.0". -->
-    <Version>0.2.8</Version>
-    <AssemblyVersion>0.2.8.0</AssemblyVersion>
-    <FileVersion>0.2.8.0</FileVersion>
-    <InformationalVersion>0.2.8</InformationalVersion>
+    <Version>0.2.9</Version>
+    <AssemblyVersion>0.2.9.0</AssemblyVersion>
+    <FileVersion>0.2.9.0</FileVersion>
+    <InformationalVersion>0.2.9</InformationalVersion>
     <!-- Default release manifest: requireAdministrator (one UAC at
          launch, every child op inherits elevation). CI smoke test
          jobs pass -p:CiBuild=true to swap in app.ci.manifest which

src/daemon/NKS.WebDevConsole.Daemon/Program.cs

@@ -212,22 +212,36 @@
 
 // Port probing: 5000 is ASP.NET's default but macOS Sequoia's AirPlay
 // Receiver (ControlCenter) squats on it with SO_REUSEADDR so the daemon
-// can't bind. Try 5000–5019 and use whichever is free. Electron reads
-// the actual port from the tmp port file so it reconnects correctly.
+// can't bind cleanly. We need BOTH loopback families free — Electron's
+// frontend connects to `localhost:PORT` which resolves to `::1` first on
+// macOS, and if AirTunes owns `::1:5000` the client gets 403 Forbidden
+// from AirTunes while our Kestrel listens happily on 127.0.0.1:5000.
+// Probe IPv4 + IPv6 and only pick a port where both are free.
 int chosenPort = 5000;
 for (int p = 5000; p < 5020; p++)
+{
+    if (!IsLoopbackPortFree(System.Net.IPAddress.Loopback, p)) continue;
+    if (!IsLoopbackPortFree(System.Net.IPAddress.IPv6Loopback, p)) continue;
+    chosenPort = p;
+    break;
+}
+static bool IsLoopbackPortFree(System.Net.IPAddress addr, int port)
 {
     try
     {
-        using var probe = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, p);
+        using var probe = new System.Net.Sockets.TcpListener(addr, port);
         probe.Start();
         probe.Stop();
-        chosenPort = p;
-        break;
+        return true;
+    }
+    catch (System.Net.Sockets.SocketException)
+    {
+        return false;
     }
-    catch (System.Net.Sockets.SocketException) { /* try next */ }
 }
-builder.WebHost.UseUrls($"http://127.0.0.1:{chosenPort}");
+// Bind to BOTH families so `localhost` (→ ::1) and `127.0.0.1` both hit
+// the daemon. Kestrel accepts multiple --urls values.
+builder.WebHost.UseUrls($"http://127.0.0.1:{chosenPort}", $"http://[::1]:{chosenPort}");
 
 var app = builder.Build();
 app.UseWebSockets();

src/frontend/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@nks-hub/webdev-console",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Unified local development environment for Windows, macOS, and Linux \u2014 manage Apache/Nginx, PHP versions, MySQL/MariaDB, and SSL from one interface.",
   "author": {
     "name": "NKS Hub",