docs(deploy): record final port layout — funnel exposes only the read-only path

Full endpoint stays tailnet-only on plain 8211 (WireGuard-encrypted); the
public Funnel on :8443 carries only /http/api-key-readonly (59 read-only
tools, 0 mutating). Port 443 is owned by an existing Caddy container on the
host, which is why serve/10000 variants were abandoned. Marks E13.4 done.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>