Manifests publish software ports; the machine side is the assignment's

postgres, distribution, gitea, mailu, only-office and portainer published
long-form mappings (5432:5432, 222:22, 7080:80, 9090:9000 …): a machine port
in a definition (ADR 0038, the migration note). Each now publishes the
software's port and names it in listens (mailu's web/web-tls and
only-office's and portainer's web said the machine number); mailu's env
says ${port:80}/${port:443} instead of 7080/7443.

Nothing moves on novox. postgres, distribution and gitea already have their
machine ports as novox settings (6852, 5100, 222); mailu, only-office and
portainer need theirs set BEFORE this rolls out:
  settings set mailu {"ports":{"80":7080,"443":7443}} --node novox
  settings set only-office {"ports":{"80":9070}} --node novox
  settings set portainer {"ports":{"9000":9090,"9443":9443}} --node novox
Those pins are accepted by today's manifests too (GivenPorts answers to the
container port), so setting them first changes nothing either.

Verified with the controller's own publishedOn/portInto/GivenPorts on
novox's settings (+ the three pins): every container's published ports and
mailu's env file render byte-identical before and after — mesh-store
6852:5432, mesh-registry 5100:5000, gitea 222:22, mailu-front 7080:80
7443:443 (+ mail ports), only-office 9070:80, portainer 9090:9000 9443:9443.

Not included: nats publishes 127.0.0.1:8222:8222 — a loopback bind, which a
short form cannot express; its monitor port needs its own change.

modules/portainer/module.json

@@ -8,10 +8,10 @@
   "listens": [
     {
       "name": "web",
-      "port": 9090,
+      "port": 9000,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "the dashboard over http; portainer.novox.be is a route grant and the proxy reaches it here \u2014 the machine side of 9090:9000, the predecessor's number"
+      "why": "the dashboard over http; routed, so the proxy reaches it here"
     },
     {
       "name": "web-tls",
@@ -39,8 +39,8 @@
       "name": "portainer",
       "image": "portainer/portainer-ce@sha256:4d616db18cfeb5dd41a69c0958bc825c84483ea9cde1106eb82a5d26f3bd8b0e",
       "ports": [
-        "9090:9000",
-        "9443:9443"
+        "9000",
+        "9443"
       ],
       "volumes": [
         "${dir:data}:/data",