feat: improve installer network setup

scripts/test-installer.sh

@@ -85,6 +85,62 @@ bash -c '
   fi
 ' _ "$installer_lib" "$tmp/mode" "$tmp/user-parent"
 
+# The port probe must distinguish a listening TCP port from a free one.
+port_tools="$tmp/port-tools"
+mkdir -p "$port_tools"
+printf '%s\n' '#!/usr/bin/env bash' 'printf "%s\\n" "LISTEN 0 128 127.0.0.1:3443 0.0.0.0:*"' > "$port_tools/ss"
+chmod 755 "$port_tools/ss"
+bash -c '
+  script=$1
+  tools=$2
+  set --
+  source "$script"
+  PATH="$tools:$PATH"
+  state=0
+  port_listener_state 3443 || state=$?
+  [[ "$state" == 1 ]]
+  state=0
+  port_listener_state 3444 || state=$?
+  [[ "$state" == 0 ]]
+' _ "$installer_lib" "$port_tools"
+
+# The lsof fallback must treat its normal "no matches" exit status as a free
+# port, while still reporting a listener when it returns a PID.
+lsof_tools="$tmp/lsof-tools"
+mkdir -p "$lsof_tools"
+printf '%s\n' '#!/usr/bin/env bash' 'exit 127' > "$lsof_tools/ss"
+printf '%s\n' '#!/usr/bin/env bash' 'case "$*" in *TCP:3443*) printf "%s\\n" 4242; exit 0 ;; *) exit 1 ;; esac' > "$lsof_tools/lsof"
+chmod 755 "$lsof_tools/ss" "$lsof_tools/lsof"
+bash -c '
+  script=$1
+  tools=$2
+  set --
+  source "$script"
+  PATH="$tools:$PATH"
+  state=0
+  port_listener_state 3443 || state=$?
+  [[ "$state" == 1 ]]
+  state=0
+  port_listener_state 3444 || state=$?
+  [[ "$state" == 0 ]]
+' _ "$installer_lib" "$lsof_tools"
+
+# Public-IP discovery accepts a valid IPv4 response and rejects malformed
+# values without making the test depend on an external service.
+bash -c '
+  script=$1
+  set --
+  source "$script"
+  PUBLIC_IP_URL=https://ip.example.test
+  curl() { printf "%s\\n" "198.51.100.7"; }
+  [[ "$(detect_public_ipv4)" == "198.51.100.7" ]]
+  curl() { printf "%s\\n" "999.1.1.1"; }
+  if detect_public_ipv4 >/dev/null 2>&1; then
+    echo "expected invalid public IPv4 response to fail" >&2
+    exit 1
+  fi
+' _ "$installer_lib"
+
 # Duplicate security-sensitive EnvironmentFile assignments are rejected even
 # when the first value looks valid (systemd uses the later value).
 duplicate_env="$tmp/duplicate.env"
@@ -183,6 +239,20 @@ bash -c '
   stat_mode_bits() { printf "384"; }
   validate_existing_env "$env_file"
 ' _ "$installer_lib" "$tmp/public-https.env"
+printf '%s\n' \
+  'TALLYNOTE_HOST=::1' \
+  'TALLYNOTE_PORT=3443' > "$tmp/ipv6-default-origin.env"
+bash -c '
+  script=$1
+  env_file=$2
+  set --
+  source "$script"
+  PREFIX=/opt/tallynote
+  DATA_DIR=/var/lib/tallynote
+  stat_uid() { printf "0"; }
+  stat_mode_bits() { printf "384"; }
+  validate_existing_env "$env_file"
+' _ "$installer_lib" "$tmp/ipv6-default-origin.env"
 if bash -c '
   script=$1
   set --