fix(daemon): port probe 5000-5019 + exec bit on single-file binaries

v0.2.8 — three issues surfaced during E2E testing of v0.2.7:

1. Daemon hardcoded to port 5000. macOS Sequoia's AirPlay Receiver
   (ControlCenter) binds that port with SO_REUSEADDR so Kestrel fails
   with AddressInUseException on startup — app launches, daemon dies
   silently, user sees "waiting for backend" forever. Now probes 5000
   through 5019 and uses the first free port; Electron already reads
   the actual port from the tmp port file so reconnection is automatic.

2. BinaryDownloader.ExtractAsync's single-file path (hint=bin/exe or
   no extension) called File.Copy with no chmod — GitHub serves the
   file as 0644, so ~/.wdc/binaries/mkcert/1.4.4/mkcert-v1.4.4-darwin-arm64
   arrived without the execute bit. Every mkcert CLI invocation died
   with EACCES until the user manually chmod+x'd it. SSL site creation
   silently failed because of this — cert.pem was never written. Now
   sets UserExecute|GroupExecute|OtherExecute on Unix after the copy.

3. Frontend + daemon bumped to 0.2.8 to ship the fix.

Pulls nks.wdc.apache-v1.0.8 via stage-plugins: Apache now re-renders
httpd.conf on graceful reload, so `Listen 443` is emitted when an SSL
cert exists (v0.2.7 had the 443 vhost but no Listen binding → ERR_CONN
on https).

Author: lukyrys

src/daemon/NKS.WebDevConsole.Daemon/Binaries/BinaryDownloader.cs

@@ -110,6 +110,25 @@ public async Task<string> ExtractAsync(
                 : guessedName;
             var dest = Path.Combine(destinationDir, canonical);
             await Task.Run(() => File.Copy(archivePath, dest, overwrite: true), ct);
+            // Bare-binary downloads arrive from GitHub as 0644 — no executable
+            // bit. Without this the `chmod +x` step every user would otherwise
+            // need to do manually, mkcert / cloudflared etc. fail with
+            // EACCES the first time the plugin tries to run them. Tar/zip
+            // extractors already honour in-archive mode bits; this path had
+            // nothing to copy the bit from, so set it explicitly.
+            if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+            {
+                try
+                {
+                    var current = File.GetUnixFileMode(dest);
+                    File.SetUnixFileMode(dest,
+                        current | UnixFileMode.UserExecute | UnixFileMode.GroupExecute | UnixFileMode.OtherExecute);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogDebug(ex, "Could not set executable bit on {Path}", dest);
+                }
+            }
             return destinationDir;
         }
 

src/daemon/NKS.WebDevConsole.Daemon/NKS.WebDevConsole.Daemon.csproj

@@ -33,10 +33,10 @@
     <!-- F92: single source of truth for daemon version. Keep in sync with
          src/frontend/package.json on every bump so /api/status and
          /api/system return the real shipped version instead of hardcoded "0.1.0". -->
-    <Version>0.2.7</Version>
-    <AssemblyVersion>0.2.7.0</AssemblyVersion>
-    <FileVersion>0.2.7.0</FileVersion>
-    <InformationalVersion>0.2.7</InformationalVersion>
+    <Version>0.2.8</Version>
+    <AssemblyVersion>0.2.8.0</AssemblyVersion>
+    <FileVersion>0.2.8.0</FileVersion>
+    <InformationalVersion>0.2.8</InformationalVersion>
     <!-- Default release manifest: requireAdministrator (one UAC at
          launch, every child op inherits elevation). CI smoke test
          jobs pass -p:CiBuild=true to swap in app.ci.manifest which

src/daemon/NKS.WebDevConsole.Daemon/Program.cs

@@ -210,6 +210,25 @@
 var migrationRunner = new MigrationRunner(earlyLoggerFactory.CreateLogger<MigrationRunner>());
 migrationRunner.Run(database.ConnectionString);
 
+// Port probing: 5000 is ASP.NET's default but macOS Sequoia's AirPlay
+// Receiver (ControlCenter) squats on it with SO_REUSEADDR so the daemon
+// can't bind. Try 5000–5019 and use whichever is free. Electron reads
+// the actual port from the tmp port file so it reconnects correctly.
+int chosenPort = 5000;
+for (int p = 5000; p < 5020; p++)
+{
+    try
+    {
+        using var probe = new System.Net.Sockets.TcpListener(System.Net.IPAddress.Loopback, p);
+        probe.Start();
+        probe.Stop();
+        chosenPort = p;
+        break;
+    }
+    catch (System.Net.Sockets.SocketException) { /* try next */ }
+}
+builder.WebHost.UseUrls($"http://127.0.0.1:{chosenPort}");
+
 var app = builder.Build();
 app.UseWebSockets();
 app.UseCors();

src/frontend/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@nks-hub/webdev-console",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Unified local development environment for Windows, macOS, and Linux \u2014 manage Apache/Nginx, PHP versions, MySQL/MariaDB, and SSL from one interface.",
   "author": {
     "name": "NKS Hub",