filtering: a per-node 'expose' setting overrides a listen's source (ADR 0051)

listens.from was a manifest constant — one value for every node a module runs
on. Now a per-node setting overrides it: {"expose": {"5432": "anywhere"}} makes
postgres public on the machine it is set for while it stays from:mesh elsewhere,
and the firewall (ADR 0050) is computed from the effective source. Exposure()
validates it — a port the module does not listen on, or a source that is not
mesh/anywhere/machine, is refused rather than reaching nothing; UnusedSettings
knows 'expose' is a real destination. Tested: default mesh, setting opens it to
anywhere, bad settings refused.

internal/catalogue/settings.go

@@ -171,6 +171,11 @@ func UnusedSettings(m Manifest, layers []Layer) []string {
 	var unused []string
 	for _, layer := range layers {
 		for key := range layer.Values {
+			// `expose` is a real destination for a module that listens: it overrides a port's
+			// source (novox/hq ADR 0051), validated in Exposure, so it is not stray here.
+			if key == ExposeSetting && len(m.Listens) > 0 {
+				continue
+			}
 			unused = append(unused, fmt.Sprintf(
 				"%s sets %q, and %s has no file or contribution to merge it into",
 				layer.From, key, m.Module))