fix(apps): publish port-only install endpoints

[luckycrm]

Summary

• persist fixed all-interface host bindings for catalog endpoints explicitly selected as port-only
• preserve catalog-authored host remaps and protocols while leaving domain-mode endpoints unpublished
• repair the binding when retrying an existing failed install draft
• add regression coverage for Supabase Kong and generic remapped ports

Fixes #770.

Why

The app installer stored the routing choice but did not add a Docker host-port mapping. For Supabase, Kong therefore had no public URL, leaving GOTRUE_SITE_URL, API_EXTERNAL_URL, and SUPABASE_PUBLIC_URL unset and causing the deployment warning.

Verification

• bunx vitest run test/modules/apps/app-install-routing.test.ts (15 passed)
• bun run lint in apps/api
• full API test run: 5,157 passed, 3 skipped; the two sandbox-blocked test files were rerun with host permissions (33 passed)