A taken tunnel brings its ListenPort, even on a node the hub cannot dial

A home node behind NAT (no Endpoint → not Reachable) that took over a
tunnel must still listen on that tunnel's port: its LAN peers dial it
there. ListenPort was gated on Reachable, which conflated 'a peer dials
me here' with 'the hub can dial me' — so the takeover guard refused
overlay-up, and the guard's suggested remedy (re-place with an
endpoint) breaks a NAT'd node's path: it stops keepalive and hands the
hub a private LAN address to dial. TakeOver now carries the found
tunnel's port (already known to the controller), and the interface
listens on it when the node is not otherwise reachable. Two tests;
Endpoint-reachable nodes keep the old path unchanged.

internal/overlay/declaration.go

@@ -123,6 +123,12 @@ func config(node Node, peers []Peer, keyPath string) string {
 		if port := portOf(node.Endpoint); port != "" {
 			fmt.Fprintf(&b, "ListenPort = %s\n", port)
 		}
+	} else if node.TakesOver != nil && node.TakesOver.Port != 0 {
+		// Not dialable from the hub, but a LAN peer dials this node on the tunnel it took over,
+		// so the mesh's interface must listen on that same port (novox/hq: a taken tunnel brings
+		// its port). Without this the takeover guard refuses overlay-up, and re-placing the node
+		// with an endpoint — the guard's suggested remedy — breaks a NAT'd node's path.
+		fmt.Fprintf(&b, "ListenPort = %d\n", node.TakesOver.Port)
 	}
 	// The private key is set from a file the node wrote, so it never appears here and never
 	// travelled. Everything else in this file came from the mesh; this one line is the node's.