feat: add extraPortMappings support to ClusterSpec

[Ladas]

Summary

• Expose KIND extraPortMappings in the forge config schema via a new ports field on ClusterSpec
• Enables mapping host ports to container/NodePort ports for accessing services (Grafana, Prometheus, MLflow) from the host
• Includes config validation (unique host ports, valid port ranges), KIND config generation, and integration test

Context

Split out from the closed #2 (OTel benchmark demo). The demo content moves to praxis-proxy/experimental, but this forge CLI feature is needed independently — any forge environment that exposes NodePort services to the host needs it.

Test plan

• Integration test with tests/fixtures/port-mappings.yaml
• Validates duplicate host ports are rejected
• Validates port range (1-65535)
• KIND config correctly generates extraPortMappings entries

[praxis-bot]

Review: feat: add extraPortMappings support to ClusterSpec

Clean feature addition overall. The CreateClusterConfig struct is a good refactor over the growing parameter list, validation is thorough (port ranges, protocol, bind address, cross-scope conflicts), and test coverage is solid. Two medium findings below.

[praxis-bot]

[Medium] Intra-cluster duplicate detection ignores bind_address, inconsistent with check_cross_scope_port_conflicts which includes it in the key.

With the current key (pm.host, pm.protocol), two port mappings on different bind addresses within the same cluster (e.g. 127.0.0.1:8080/tcp and 10.0.0.1:8080/tcp) are rejected as duplicates even though they do not conflict. Meanwhile check_port_collision (used by check_cross_scope_port_conflicts) correctly allows this by including bind_address in the key.

Include bind_address in the intra-cluster duplicate key to match:

let key = (
    pm.bind_address.clone().unwrap_or_default(),
    pm.host,
    pm.protocol.to_lowercase(),
);

[praxis-bot]

[Medium] The listenAddress generation branch (line 160-162) is not covered by any unit test. Both port mappings here use bind_address: None, so the if let Some(addr) = &pm.bind_address path is never exercised.

Add a port with a bind_address to this test (or a dedicated test) and assert the generated YAML contains the expected listenAddress entry:

PortMapping {
    bind_address: Some("127.0.0.1".to_owned()),
    host: 9090,
    container: 30909,
    protocol: "tcp".to_owned(),
},

then:

assert!(
    yaml.contains("listenAddress: \"127.0.0.1\""),
    "should include listenAddress for bind_address",
);