[codex] configurable Agent API port

[hydro13]

Summary

Adds configurable Tandem Agent API endpoint settings so users can change the Agent API port from the default 8765 while preserving local MCP/HTTP clients and remote agents on trusted Tailscale/private networks.

What changed

• Added persistent general.apiPort config with strict TCP port validation.
• Kept apiListenHost separate from apiPort and preserved supported remote listen behavior for private overlay networks.
• Added endpoint discovery helpers and bootstrap artifacts: api-port and api-endpoints.json, without replacing api-token.
• Updated API startup/preflight, MCP/API clients, shell API helpers, extensions, CLI, X-Scout, and smoke tests to use the configured loopback endpoint.
• Added a compact Settings > Connected Agents Agent API section with port input, local endpoint preview, remote/Tailscale preview, listen host display, validation, and restart-required copy.
• Added paired-agent startup enforcement: new binding tokens must read /skill, /agent/manifest, and /agent/bootstrap before normal API/MCP routes unlock.
• Updated docs, skill guidance, platform support docs, changelog, TODO, and version metadata for v1.11.0.

Behavior notes

• Same-machine clients use http://127.0.0.1:<configured-port>.
• Remote paired agents are instructed to use http://<tailscale-or-private-ip>:<configured-port> when remote access is enabled.
• Loopback-only mode disables or warns for remote endpoint display.
• Port conflicts fail clearly and do not blindly terminate unrelated processes.
• Public-WAN exposure is not documented or claimed as supported.
• ~/.tandem/api-token remains a compatibility contract.

Validation

• npm run verify: passed, including compile, lint, Vitest, and consistency check.
• npx tsc: passed.
• npx vitest run: passed, 2968 tests passed, 39 skipped.
• actionlint .github/workflows/verify.yml: passed.
• Manual default startup: http://127.0.0.1:8765/status reachable and process exits cleanly.
• Manual custom startup: configured 9876, http://127.0.0.1:9876/status reachable and default 8765 inactive for that instance.
• Manual settings persistence: changing 8765 -> 8766 -> 8765 survives restart and internal settings URLs normalize stale port params.
• Manual remote metadata: remote/Tailscale-facing instructions use the configured port and do not advertise 127.0.0.1 for remote agents.
• Manual local-only behavior: remote endpoint display warns/disables when listen mode is loopback-only.
• Manual invalid ports: empty, text, 0, -1, 65536, and decimals are rejected without corrupting config.
• Manual port conflict behavior: unrelated listener is not killed; Tandem reports a clear configured-port conflict.
• Manual paired-agent startup gating: normal API calls return 428 agent_startup_required until /skill, /agent/manifest, and /agent/bootstrap are read with the Bearer token, then /chat returns 200.

Platform notes

• No new dependencies were added.
• Windows 11 x64 source startup was manually tested with default and custom ports on Robin's machine.
• macOS CI should remain the required Tier 1 confirmation before merge.
• Linux remains best-effort/non-blocking unless shared runtime behavior regresses.