feat(web-portal): serve on port 80, drop Mainsail/Fluidd socat redirects

[martinbogo]

Summary

Moves the Rinkhals web portal to port 80 so the printer's bare IP opens it directly, and removes the per-connection socat redirects that Mainsail and Fluidd used to put themselves on port 80.

Why

The socat redirect (socat TCP-LISTEN:80,reuseaddr,fork TCP:localhost:44xx) forks a process per connection and copies every byte through userspace. It was only ever a convenience to reach the human Mainsail/Fluidd UI at the bare IP; slicer and automation uploads go to Moonraker, not through it.

The kernel-level alternative (iptables/nftables REDIRECT) is not available on this hardware: the vendor kernel has no netfilter at all (no nat or even filter table, no loadable modules, no modprobe), same as the missing swap/cron/ftrace. Since rinkhals-web is our own process running as root, the lightest possible solution is to bind port 80 directly, which is what this does.

Changes

• 65-rinkhals-web/web_server.go: listen on :80 (primary) and keep :8090 (goroutine) for one transition cycle, so existing bookmarks and the Vite dev workflow keep working.
• 25-mainsail/app.sh, 26-fluidd/app.sh: remove the socat :80 redirect and its pid handling. Mainsail stays on :4409, Fluidd on :4408.
• Docs: bare IP is now the web portal; Mainsail/Fluidd move to their own ports; architecture doc updated; and the OrcaSlicer guide now points slicer uploads at Moonraker's OctoPrint-compatible API on :7125.

User-facing impact (call out in the release notes and Discord)

• Bare printer IP now opens the Rinkhals web portal (login admin/rinkhals), not Mainsail.
• Mainsail/Fluidd move to :4409 / :4408.
• OrcaSlicer users must repoint their OctoPrint host from the bare IP to http://<printer-ip>:7125 (Moonraker). OrcaSlicer defaults to port 80, which is now the password-protected portal, so the old bare-IP setup will fail. The OrcaSlicer guide is updated accordingly.
• :8090 still works this cycle and can be dropped in a later release.

Testing notes

• go build / go vet clean.
• Not yet validated on hardware for the :80 bind + socat removal end-to-end; worth confirming on a printer that the portal answers on the bare IP, Mainsail is reachable on :4409, and an OrcaSlicer upload to :7125 works, before this rides into a stable release.

Follow-up

• Announce the port change on Discord when this ships.
• Consider dropping :8090 in a subsequent release once users have migrated.