Serve the API on 3000 and 8000 at once, matching the frontend image

Dokploy routes the domain to port 3000, but the container only bound 8000, so
the proxy had nothing to talk to and the domain returned 502 with a perfectly
healthy process behind it.

The frontend image already solved this by answering on both 80 and 3000
(`listen 80; listen 3000;` in nginx.conf). Do the same here rather than swap one
guess for another: 3000 is what the platform routes to, and 8000 is what the
README, the vite dev proxy and docker-compose all target, so binding both means
the container works whichever one it is pointed at.

uvicorn's CLI takes a single --port, but Server.run() accepts pre-bound
sockets, so serve.py binds each port and hands the list to one uvicorn - no
extra worker or second process to supervise. PORT still pins a single port for
anyone who wants one; PORTS changes the pair.

A port that cannot be bound is logged and skipped rather than being fatal,
since losing one of the two should not take down a service the platform only
routes to on the other. It exits non-zero only when nothing is listening at
all, so a genuinely dead container is still reported as failed.

The healthcheck moves into the same file and passes if either port answers,
which keeps it from drifting out of sync with what is actually bound.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.env.example

@@ -16,6 +16,19 @@
 # localhost URL points the backend at its own empty ports. Containers reach
 # each other by service name over the compose network instead.
 
+# --- Ports (container only) -----------------------------------------------
+# The image serves 3000 and 8000 at once - 3000 because that is what Dokploy
+# routes a domain to, 8000 because the README, the vite dev proxy and
+# docker-compose all use it. Serving both means the container works whichever
+# one the platform points at.
+#
+# PORTS  the comma-separated pair to bind. PORT pins a single port instead and
+#        takes precedence, e.g. PORT=8080 serves only 8080.
+#
+# Neither affects running uvicorn directly for local development.
+# PORTS=3000,8000
+# PORT=8080
+
 # --- Persistence (IMPORTANT in Docker) ------------------------------------
 # The three directories the app WRITES to at runtime. The defaults point inside
 # the repo/image and are right for local development; in a container each one