…tes kernel-assigned ports (#1674)

Rolled up in full: golang.org/x/crypto 0.55.0 -> 0.56.0 (#1649), github.com/getkin/kin-openapi 0.147.0 -> 0.149.0 (#1650), docker/setup-qemu-action v4.2.0 -> v4.3.0 (#1651), actions/deploy-pages v5.0.0 -> v5.0.1 (#1652). Both action SHAs match their upstream tag objects.

From the npm security group (#1669), the two fixes it names: sharp 0.35.0 -> 0.35.4 and the js-yaml override to ^4.3.2. Vitest stays at ^4.1.0. That PR also carries vitest 5.0.0 because @vitest/mocker shares the group, and vitest 5 changed Assertion to two required type parameters while @testing-library/jest-dom still augments a one-parameter form. Declaration merging then fails and every matcher goes invisible to the type checker: 2172 tests pass, tsc -b reports 1307 errors. jest-dom 7.0.1 does not fix it and testing-library/jest-dom#738 has no released fix, so #1669 stays open for dependabot to re-propose.

npm audit had two high-severity findings that #1669 did not reach. The brace-expansion override pins had fallen inside the widened advisory range and move to ^1.1.18, ^2.1.4 and ^5.0.9; nanoid, reached only through postcss, gets a scoped nanoid@3 override at ^3.3.18. npm audit now reports none.

migrate-check and test-realdb each bound a fixed host port, 55432 and 55433. This machine runs many projects at once, and a fixed port is a standing appointment to collide with one of them: another project's Postgres held 55432 and the migration gate died on the bind rather than on anything in the diff. Both now publish with -p 127.0.0.1::5432 and read the assigned port back with docker port, so the kernel picks one that is free at that instant. Nothing outside these gates reaches the containers, so the port never had to be predictable. The dev stack is untouched; it already relocates by probing, and its ports are addressed by people and by the Keycloak realm's redirect URIs.