fix: persist host port and compat mode in config.toml

The host-side port mapping and seccomp compatibility-mode selections
were only used in-memory for docker run args and never written to
config.toml, so a re-run of the installer couldn't recover them as
form defaults (worse, the host port field silently defaulted to the
container's internal port). Add host_port and seccomp_unconfined to
[server] and decode them back via AppConfig.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/tui/config_test.go

@@ -60,6 +60,12 @@ func TestGenerateConfigTOML_RoundTrip(t *testing.T) {
 	if cfg.Server.Environment != "production" {
 		t.Errorf("environment = %q, want %q", cfg.Server.Environment, "production")
 	}
+	if cfg.Server.HostPort != 9090 {
+		t.Errorf("host_port = %d, want 9090", cfg.Server.HostPort)
+	}
+	if cfg.Server.SeccompUnconfined {
+		t.Errorf("seccomp_unconfined = true, want false")
+	}
 	if cfg.Database.Type != "postgres" {
 		t.Errorf("database type = %q, want %q", cfg.Database.Type, "postgres")
 	}
@@ -103,8 +109,8 @@ func TestGenerateConfigTOML_PortIsAlwaysContainerPort(t *testing.T) {
 	if cfg.Server.Port != containerAppPort {
 		t.Errorf("config port = %d, want fixed containerAppPort %d", cfg.Server.Port, containerAppPort)
 	}
-	if strings.Contains(out, "port = 9090") {
-		t.Errorf("host port 9090 leaked into config.toml:\n%s", out)
+	if cfg.Server.HostPort != 9090 {
+		t.Errorf("host_port = %d, want 9090", cfg.Server.HostPort)
 	}
 }