Allocate dynamic development ingress ports

## Outcome Remove fixed host ports from the Rust-owned development environment. Docker Compose allocates loopback ports, `cargo dev` discovers and persists the effective identity, Mailpit, and diagnostic RP endpoints, and `cargo dev up`/`status` report those URLs. ## Constraints - Keep container-internal service ports fixed and the application network egress-denied. - Keep the identity issuer and synthetic OIDC callback/logout URLs synchronized with discovered host ports through compatible repository/bootstrap behavior. - Do not expose PostgreSQL over TCP or weaken resource-ownership/destructive guards. ## Acceptance criteria - `cargo dev init` and `up` succeed when the former fixed host ports are occupied. - `up` and `status` report the actual allocated loopback URLs. - OIDC RP redirect/logout works using the discovered ports. - Existing Rust database/contract safety gates and lifecycle cleanup pass.