fix(gateway): validate TCP port range

[Elioooon]

Scope

Scope boundary: Validate persisted gateway ports and gateway CLI --port overrides before persistence or process startup.

Non-goals: Change valid-port lifecycle behavior or replace the existing readiness/error model.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: Fixes #1539

Release Note

Release note: Reject gateway ports outside 0-65535 before saving configuration or starting a process.

Tests

Ruff: uv run ruff check src tests (passed)

Pytest: uv run pytest -q tests/test_cli/test_config_set_key_validation.py tests/test_cli/test_gateway_cmd.py (84 passed)

Build: npm --prefix opensquilla-webui run build and uv build --wheel (passed)

Regression tests: added

Notes: The full uv run pytest -q reached 1,529 passed and 61 skipped before hitting the pre-existing tests/test_ci/test_migrations_packaged.py::test_usage_query_client_source_is_part_of_webui_build_inputs failure. The same assertion fails on a detached, unmodified origin/main worktree because useUsageQuery.ts no longer contains the expected USAGE_QUERY_METHOD constant.

The default test path remains offline, deterministic, credential-free, and safe for forks.

Maintainer Live Check

Maintainer live check: no

Surface: gateway

Maintainer-only note: contributors are not expected to provide secrets or run credentialed live checks. Maintainers may run Live Release E2E for provider, browser, gateway, channel, or release smoke coverage.

Safety

No secrets, local-only artifacts, private prompts/transcripts, channel identifiers, AI session artifacts, non-public fixtures, or tests/_private/ contents are included.

Third-Party Origin

Third-party origin: none

Details if non-none: N/A

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.