Make embed proxy ports configurable via env vars for multi-instance deployments

All 13 nginx embed proxy ports (8881-8895) are now driven by environment
variables instead of being hardcoded. This prevents port conflicts when
running multiple Changemaker instances on the same host.

Chain: .env → docker-compose port mappings → nginx container env →
entrypoint.sh envsubst → services.conf.template listen directives →
API /services/config endpoint → frontend buildServiceUrl().

Existing deployments are unaffected (all vars default to current values).

Bunker Admin

.env.example

@@ -58,6 +58,23 @@ ADMIN_URL=http://localhost:3000
 NGINX_HTTP_PORT=80
 NGINX_HTTPS_PORT=443
 
+# --- Embed Proxy Ports ---
+# Dedicated nginx ports for iframe embedding without DNS/subdomain.
+# Change these to avoid port conflicts when running multiple instances on one host.
+NOCODB_EMBED_PORT=8881
+N8N_EMBED_PORT=8882
+GITEA_EMBED_PORT=8883
+MAILHOG_EMBED_PORT=8884
+MINI_QR_EMBED_PORT=8885
+EXCALIDRAW_EMBED_PORT=8886
+HOMEPAGE_EMBED_PORT=8887
+VAULTWARDEN_EMBED_PORT=8890
+ROCKETCHAT_EMBED_PORT=8891
+GANCIO_EMBED_PORT=8892
+JITSI_EMBED_PORT=8893
+GRAFANA_EMBED_PORT=8894
+ALERTMANAGER_EMBED_PORT=8895
+
 # --- SMTP / Email ---
 SMTP_HOST=mailhog-changemaker
 SMTP_PORT=1025
@@ -212,24 +229,20 @@ USER_NAME=coder
 
 # --- Homepage ---
 HOMEPAGE_PORT=3010
-HOMEPAGE_EMBED_PORT=8887
 HOMEPAGE_VAR_BASE_URL=http://localhost
 
 # --- Mini QR ---
 MINI_QR_PORT=8089
 MINI_QR_URL=http://mini-qr:8080
-MINI_QR_EMBED_PORT=8885
 
 # --- Excalidraw (Collaborative Whiteboard) ---
 EXCALIDRAW_PORT=8090
 EXCALIDRAW_URL=http://excalidraw-changemaker:80
-EXCALIDRAW_EMBED_PORT=8886
 EXCALIDRAW_WS_URL=wss://draw.cmlite.org
 
 # --- Vaultwarden (Password Manager) ---
 VAULTWARDEN_PORT=8445
 VAULTWARDEN_URL=http://vaultwarden-changemaker:80
-VAULTWARDEN_EMBED_PORT=8890
 # Admin panel token (access at /admin) — generate with: openssl rand -hex 32
 VAULTWARDEN_ADMIN_TOKEN=
 # MUST use HTTPS — Bitwarden web vault enforces HTTPS for account creation
@@ -302,13 +315,11 @@ ENABLE_CHAT=false
 ROCKETCHAT_ADMIN_USER=rcadmin
 ROCKETCHAT_ADMIN_PASSWORD=REQUIRED_STRONG_PASSWORD_CHANGE_THIS
 ROCKETCHAT_URL=http://rocketchat-changemaker:3000
-ROCKETCHAT_EMBED_PORT=8891
 
 # --- Gancio (Event Management) ---
 # Uses shared PostgreSQL (database: gancio, auto-created by init-gancio-db.sh)
 GANCIO_PORT=8092
 GANCIO_URL=http://gancio-changemaker:13120
-GANCIO_EMBED_PORT=8892
 GANCIO_BASE_URL=https://events.cmlite.org
 # Gancio admin credentials for shift-to-event sync (OAuth login)
 GANCIO_ADMIN_USER=admin
@@ -328,18 +339,12 @@ JITSI_APP_SECRET=GENERATE_WITH_openssl_rand_hex_32
 # Generate each with: openssl rand -hex 16
 JITSI_JICOFO_AUTH_PASSWORD=GENERATE_WITH_openssl_rand_hex_16
 JITSI_JVB_AUTH_PASSWORD=GENERATE_WITH_openssl_rand_hex_16
-# Embed port for admin iframe
-JITSI_EMBED_PORT=8893
 JITSI_URL=http://jitsi-web-changemaker:80
 # JVB public IP (required for NAT traversal — set to server's public IP in production)
 JVB_ADVERTISE_IP=
 # JVB UDP port for media traffic (must be open in firewall)
 JVB_PORT=10000
 
-# --- Monitoring Embed Ports (iframe embedding) ---
-GRAFANA_EMBED_PORT=8894
-ALERTMANAGER_EMBED_PORT=8895
-
 # --- SMS Campaigns (Termux Android Bridge) ---
 # ENABLE_SMS is the initial default; once saved in admin Settings, the DB value is authoritative
 # URL + API key are typically managed via admin Settings page (DB overrides env)