Preflight validation and live startup visibility for self-hosted installs

make up now runs a preflight pass against the host before starting any container. The checks cover port conflicts, database password mismatches against the running volume, unrotated default secrets, an ADMIN_BIND exposed beyond loopback, container CPU limits set above host cores, and — for production environments — missing TLS termination upstream. Hard failures stop the start; warnings are listed and can be overridden with KLYVEX_PREFLIGHT=warn or skipped entirely with KLYVEX_SKIP_PREFLIGHT=1.

After containers come up, make up prints a table of URLs, ports, and a live health column. make health now reports per-container status instead of only web and gateway.

Two new docs pages support this: a Ports & URLs reference, and a deployment guide that contrasts on-prem and hosted/SaaS modes.

No action required. The preflight gate is opt-out, not opt-in.