Default the service port to the image's EXPOSE

Sub-issue of MIR-1430 (RFD-91). Independent of the entrypoint change; low risk.

A web service defaults to 3000 and Miren never reads the image's EXPOSE, so an upstream image on its own port (Chatto 4000, Ghost 2368, Gitea 3000) needs an explicit port line or it fails the :3000 health check and falls back to singleAlternativePort after a timeout and a warning.

Behavior:

• Read ExposedPorts from the image config at build time. servers/build/buildkit.go already extracts Entrypoint/Cmd/WorkingDir from the image config; add exposed ports alongside.
• When a service sets no port, default it to the image's exposed port (controllers/deployment/launcher.go).
• Single exposed port → use it directly. Multiple → keep requiring an explicit port (mirror the caution singleAlternativePort already takes).
• $PORT keeps tracking the resolved port (the launcher already injects it).

Ref: RFD-91, "Ports: inherit what the image exposes".