Make the listen port configurable via PORT

app.py's dev server and gunicorn both hardcoded 5000, which is awkward
locally — macOS ControlCenter already holds that port, so the app can't
bind on the dev laptop without editing source.

Both now read PORT, defaulting to 5000 so EXPOSE, the compose
`${HOST_PORT}:5000` mapping and the deployed container are unchanged.
Read at run time rather than import time so a dev harness can assign a
free port.

Also tracks .claude/launch.json with autoPort set. It doesn't actually
launch on this machine — the preview sandbox can't read files under
~/Desktop — so CLAUDE.md notes that running from a shell with an
explicit PORT is the working local path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -143,6 +143,16 @@ reload alone will silently serve the cached template. And the login
 password comes from `LOGIN_PASSWORD`, so set it explicitly rather than
 hunting for the real one.
 
+The listen port comes from `PORT` (default `5000`, matching `EXPOSE`,
+`gunicorn.conf.py` and the `${HOST_PORT}:5000` compose mapping — change
+all four together or none). Set it when running locally: macOS
+`ControlCenter` already holds port 5000, so `python3 app.py` with no
+`PORT` will fail to bind on the dev laptop. `.claude/launch.json` sets
+`autoPort` so a dev harness can assign a free one, but note that on this
+machine the preview sandbox can't read files under `~/Desktop`
+("Operation not permitted"), so launching by name fails and running the
+app from a shell on an explicit `PORT` is the working path.
+
 ## Deployment
 
 **Target:** Unraid server, container path `/mnt/user/appdata/greendale`