dankserver: copyparty PublishPort=3923 + seam pinning host-served ports

The cutover unit joined dankserver_appnet but dropped the compose-era
0.0.0.0:3923 mapping (live inspect: bridge, 3923 published), so
copyparty listened inside the netns while the host refused. New seam
asserts every host-facing port matches the pre-cutover PortBindings:
romm 8085->8080, jellyfin 8096, calibre-web 8083, copyparty 3923.

dankserver/copyparty/quadlet/copyparty.container

@@ -27,6 +27,7 @@ EnvironmentFile=/home/dank/Containers/copyparty/env
 Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
 Volume=/mnt/entropy:/w
 Volume=/home/dank/Containers/copyparty/cfg:/cfg
+PublishPort=3923:3923
 
 [Service]
 EnvironmentFile=/home/dank/Containers/copyparty/env