docs(calibre-server): correct the port map - pasta is port-forward mode

Only the 8084 forward is exposed; the desktop GUI runs inside the
container netns and is internal-only. Drop the now-unneeded
CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns).

dankserver/calibre-server/quadlet/calibre-server.container

@@ -10,15 +10,20 @@
 # serverAppConfigs-docs/Dankserver/Calibre.md predates the desktop revamp;
 # the dedicated headless images (ta264/docker-calibre, agentgreen) are
 # dormant (calibre 6.10 / 2017), so this unit runs calibre-server as the
-# image's s6-overlay main service via Exec= and keeps the desktop as a
-# bonus (browser GUI on 8080, basic-authed via the env file).
-#
-# Port map (Network=pasta, so container ports bind on the host directly):
-#   8090 -> host 8084  calibre-server (the content server; 8080 is taken by
-#                      the image's own nginx, 8083 by calibre-web)
-#   8080 -> host 8080  desktop GUI (nginx; CUSTOM_HTTPS_PORT moved to 8182
-#                      because Tautulli holds host 8181)
+# image's s6-overlay main service via Exec=; the desktop also runs but its
+# ports are internal-only (see the port map below).
 #
+# Port map: Network=pasta is port-FORWARD mode on this host (the container
+# keeps its own netns; only PublishPort'd ports reach the host — verified
+# 2026-09-21: 8080/8090/8182 inside the container are not visible on the
+# host, only the 8084 forward). So the ONLY exposed surface is:
+#   8090 -> host 8084  calibre-server (the content server; 8080 inside the
+#                      container is the image's own nginx, 8083 on the host
+#                      is calibre-web)
+# The desktop GUI (nginx 8080/8181 + WS 8082, inside the container) runs but
+# is internal-only: no PublishPort. Exposing it is one PublishPort line away
+# if the browser GUI is ever wanted (the basic-auth credential is already in
+# the env file).
 # Auth: calibre-server 9.x keeps its users in a SQLite userdb (the pw column
 # is PLAINTEXT, so the file is mode 600). The single admin account is
 # bootstrapped once by the deploy handler (deploy_calibre_server) via
@@ -44,7 +49,6 @@ EnvironmentFile=/home/dank/Containers/calibre-server/env
 Environment=PUID=1000
 Environment=PGID=1000
 Environment=TZ=America/Vancouver
-Environment=CUSTOM_HTTPS_PORT=8182
 Volume=/home/dank/Containers/calibre-web/books:/books
 Volume=/home/dank/Containers/calibre-server/userdb.sqlite:/userdb.sqlite
 Exec=calibre-server --port 8090 --enable-auth --auth-mode=basic --userdb /userdb.sqlite /books

serverAppConfigs-docs/Dankserver/Calibre.md

@@ -55,17 +55,18 @@ The image is the current **desktop** build (Selkies web-streamed GUI), not the
 headless image the old compose snippet assumed — the dedicated headless images
 (ta264/docker-calibre, agentgreen/calibre-server) are dormant (calibre 6.10 /
 2017, both below the 9.9.0 content-server fix). The unit therefore runs
-`calibre-server` as the image's s6-overlay main service via `Exec=` and keeps
-the desktop as a bonus:
+`calibre-server` as the image's s6-overlay main service via `Exec=`.
 
 | Surface | Host port | Auth |
 |---------|-----------|------|
 | Content server (OPDS + web UI) | **8084** (internal 8090) | HTTP Basic, single admin `calibre` in the SQLite userdb |
-| Desktop GUI (bonus) | 8080 (HTTPS on 8182) | HTTP Basic, same credential |
+| Desktop GUI (internal only) | none (8080/8181/8082 inside the container) | HTTP Basic ready (`CUSTOM_USER`/`CUSTOM_PASSWORD` in the env file) |
 
-Port notes: 8080 inside the container is the image's own nginx (the desktop),
-so the content server runs on internal 8090; `CUSTOM_HTTPS_PORT=8182` avoids
-Tautulli's host 8181.
+Port notes: `Network=pasta` on this host is port-FORWARD mode — the container
+keeps its own netns and only `PublishPort`'d ports reach the host (verified
+2026-09-21). The desktop GUI runs but is unreachable: exposing the browser
+GUI is one `PublishPort` line away. 8080 *inside* the container is the
+image's own nginx (the desktop), so the content server runs on internal 8090.
 
 **Auth model (calibre 9.x):** users live in a SQLite userdb whose `pw` column
 is **plaintext** — the file is mode 600. The single admin account is