Bridge mode: dev servers started inside the container are unreachable from the host

[alanbem]

Problem

Bridge-mode documentation and the system context cover the container→host direction (host.docker.internal), but not the reverse. The only published port is the reserved SSH port, so when Claude starts a dev server inside a bridge-mode container:

Claude: "Dev server running at http://localhost:3000"
User:   opens localhost:3000 on the host → connection refused

This is arguably the most common dev workflow ("run the app so I can look at it") and it fails with no hint. Host-mode users (OrbStack, Docker Desktop beta, Linux) never see it, which hides the problem from development.

Ideas

1. Minimum: add this limitation to the bridge-mode section of generate_system_context() so Claude at least tells the user to expose a port instead of printing a dead localhost URL
2. Config option for extra published ports, e.g. PORTS=3000,8080 in .dclaude / DCLAUDE_PORTS (baked at creation — interacts with Container settings drift: env var changes not applied to existing containers #58)
3. Fancier: on-demand socat forwarding from host to container IP for requested ports, no container recreation needed

Option 1 is cheap and immediately useful; 2 covers most real cases.

---

Found during a full-project code review.