fix(installer): don't bind fresh agent services onto occupied ports

The Orange Pi install put the new service straight into a crash-restart
loop: the unit's default --port 3000 collided with a Docker service
already publishing 3000 (Umami; Gitea and friends default there too).
Fresh installs now scan 3000/3001/3010/3231/3232 via ss and configure
the unit on the first free port, warning loudly when 3000 was taken and
printing the resulting ws:// URL. Upgrades still never touch the unit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/install.sh

@@ -190,15 +190,34 @@ NoNewPrivileges=true
 WantedBy=multi-user.target
 UNIT
     fi
-    # Point ExecStart at wherever this run installed the agent.
+    # Pick the agent port: 3000 by default, but NEVER bind onto a port that
-    sed -i.bak "s|^ExecStart=[^ ]*socktop_agent|ExecStart=$PREFIX/socktop_agent|" "$UNIT_TMP"
+    # something else already holds (e.g. Gitea/Umami and friends love 3000)
+    # — that puts the fresh service straight into a crash-restart loop.
+    AGENT_PORT=""
+    for p in 3000 3001 3010 3231 3232; do
+      if ! ss -tln 2>/dev/null | awk '{print $4}' | grep -q ":${p}\$"; then
+        AGENT_PORT="$p"
+        break
+      fi
+    done
+    if [ -z "$AGENT_PORT" ]; then
+      AGENT_PORT=3000
+      warn "no free port among the defaults — using 3000; edit the unit if the service fails to start"
+    elif [ "$AGENT_PORT" != "3000" ]; then
+      warn "port 3000 is already in use by another service — configuring the agent on port $AGENT_PORT"
+    fi
+
+    # Point ExecStart at wherever this run installed the agent, on the chosen port.
+    sed -i.bak -e "s|^ExecStart=[^ ]*socktop_agent|ExecStart=$PREFIX/socktop_agent|" \
+               -e "s|--port [0-9]*|--port $AGENT_PORT|" "$UNIT_TMP"
     rm -f "$UNIT_TMP.bak"
 
     $SYS_SUDO install -o root -g root -m 0644 "$UNIT_TMP" /etc/systemd/system/socktop-agent.service
     rm -f "$UNIT_TMP"
     $SYS_SUDO systemctl daemon-reload
     $SYS_SUDO systemctl enable --now socktop-agent.service
-    say "Service installed. To enable TLS or a token, edit /etc/systemd/system/socktop-agent.service, then: sudo systemctl daemon-reload && sudo systemctl restart socktop-agent"
+    say "Service installed — agent URL: ws://$(hostname):$AGENT_PORT/ws"
+    say "To enable TLS or a token, edit /etc/systemd/system/socktop-agent.service, then: sudo systemctl daemon-reload && sudo systemctl restart socktop-agent"
   fi
   sleep 1
   systemctl --no-pager -l status socktop-agent.service | head -5 || true