Opt-in Funnel per port

[breakzplatform]

Allow marking specific ports as public via Funnel. Must be explicit per port (never a mode), must warn that Funnel is unauthenticated public internet, and must respect Funnel's 443/8443/10000 restriction with a clear error otherwise.