fix: persist host port and compat mode in config.toml

The host-side port mapping and seccomp compatibility-mode selections
were only used in-memory for docker run args and never written to
config.toml, so a re-run of the installer couldn't recover them as
form defaults (worse, the host port field silently defaulted to the
container's internal port). Add host_port and seccomp_unconfined to
[server] and decode them back via AppConfig.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/tui/config.go

@@ -14,10 +14,13 @@ func GenerateConfigTOML(cv ConfigValues) (string, error) {
 	sb.WriteString("# Server Configuration\n")
 	sb.WriteString("[server]\n")
 	// Always containerAppPort: the container listens on this port internally; the
-	// user's port is the host-side mapping (see RunAppClienteContainer).
+	// user's port is the host-side mapping (see RunAppClienteContainer). Persisted
+	// separately as host_port so it survives as the form default on a re-run.
 	sb.WriteString(fmt.Sprintf("port = %d\n", containerAppPort))
+	sb.WriteString(fmt.Sprintf("host_port = %s\n", cv.Server["port"]))
 	sb.WriteString(fmt.Sprintf("timeout_seconds = %s\n", cv.Server["timeout"]))
 	sb.WriteString(fmt.Sprintf("environment = %q\n", cv.Server["environment"]))
+	sb.WriteString(fmt.Sprintf("seccomp_unconfined = %t\n", cv.Server["seccomp_unconfined"] == "Sim"))
 	sb.WriteString("\n")
 
 	// [database]