filtering: a per-node 'expose' setting overrides a listen's source (ADR 0051)

listens.from was a manifest constant — one value for every node a module runs
on. Now a per-node setting overrides it: {"expose": {"5432": "anywhere"}} makes
postgres public on the machine it is set for while it stays from:mesh elsewhere,
and the firewall (ADR 0050) is computed from the effective source. Exposure()
validates it — a port the module does not listen on, or a source that is not
mesh/anywhere/machine, is refused rather than reaching nothing; UnusedSettings
knows 'expose' is a real destination. Tested: default mesh, setting opens it to
anywhere, bad settings refused.

internal/catalogue/declaration.go

@@ -138,8 +138,19 @@ func (r Resolution) Declaration(with Rendering) ([]map[string]any, error) {
 	}
 
 	// Once, from every module's listens -- not per module. A module receiving only its own ports
-	// would write a rule set that closed every other module on the machine.
-	rules, err := r.Filtering(with.Generators, with.Ports)
+	// would write a rule set that closed every other module on the machine. Each module's per-node
+	// exposure settings override its listens' source first (novox/hq ADR 0051).
+	exposure := map[string]map[int]string{}
+	for _, m := range r.Modules {
+		e, err := Exposure(m, with.Settings[m.Module])
+		if err != nil {
+			return nil, err
+		}
+		if e != nil {
+			exposure[m.Module] = e
+		}
+	}
+	rules, err := r.Filtering(with.Generators, with.Ports, exposure)
 	if err != nil {
 		return nil, err
 	}