docs(calibre-server): correct the port map - pasta is port-forward mode

Only the 8084 forward is exposed; the desktop GUI runs inside the
container netns and is internal-only. Drop the now-unneeded
CUSTOM_HTTPS_PORT (no host-port conflict exists inside the netns).

dankserver/calibre-server/quadlet/calibre-server.container

@@ -10,15 +10,20 @@
 # serverAppConfigs-docs/Dankserver/Calibre.md predates the desktop revamp;
 # the dedicated headless images (ta264/docker-calibre, agentgreen) are
 # dormant (calibre 6.10 / 2017), so this unit runs calibre-server as the
-# image's s6-overlay main service via Exec= and keeps the desktop as a
-# bonus (browser GUI on 8080, basic-authed via the env file).
-#
-# Port map (Network=pasta, so container ports bind on the host directly):
-#   8090 -> host 8084  calibre-server (the content server; 8080 is taken by
-#                      the image's own nginx, 8083 by calibre-web)
-#   8080 -> host 8080  desktop GUI (nginx; CUSTOM_HTTPS_PORT moved to 8182
-#                      because Tautulli holds host 8181)
+# image's s6-overlay main service via Exec=; the desktop also runs but its
+# ports are internal-only (see the port map below).
 #
+# Port map: Network=pasta is port-FORWARD mode on this host (the container
+# keeps its own netns; only PublishPort'd ports reach the host — verified
+# 2026-09-21: 8080/8090/8182 inside the container are not visible on the
+# host, only the 8084 forward). So the ONLY exposed surface is:
+#   8090 -> host 8084  calibre-server (the content server; 8080 inside the
+#                      container is the image's own nginx, 8083 on the host
+#                      is calibre-web)
+# The desktop GUI (nginx 8080/8181 + WS 8082, inside the container) runs but
+# is internal-only: no PublishPort. Exposing it is one PublishPort line away
+# if the browser GUI is ever wanted (the basic-auth credential is already in
+# the env file).
 # Auth: calibre-server 9.x keeps its users in a SQLite userdb (the pw column
 # is PLAINTEXT, so the file is mode 600). The single admin account is
 # bootstrapped once by the deploy handler (deploy_calibre_server) via
@@ -44,7 +49,6 @@ EnvironmentFile=/home/dank/Containers/calibre-server/env
 Environment=PUID=1000
 Environment=PGID=1000
 Environment=TZ=America/Vancouver
-Environment=CUSTOM_HTTPS_PORT=8182
 Volume=/home/dank/Containers/calibre-web/books:/books
 Volume=/home/dank/Containers/calibre-server/userdb.sqlite:/userdb.sqlite
 Exec=calibre-server --port 8090 --enable-auth --auth-mode=basic --userdb /userdb.sqlite /books