Reconcile the port 8080 guidance across Generator pages

[johnnymatthews]

Operators have asked whether the health check needs :8080 open publicly or whether :9171 is enough. I confirmed 8080 has to be open publicly. The question is fair, because the docs currently answer it both ways:

• The register page (content/run/run-a-generator/register/index.md) says "open inbound TCP 8080 in your firewall", because the public dashboard probes http://<your-server-ip>:8080/health to decide whether a Generator shows as online.
• The install page's exposed ports table (content/run/run-a-generator/install/index.md) says 8080 should not be published publicly, and to keep it private or behind a reverse-proxy allowlist in production.
• The security page's port exposure table (content/run/run-a-generator/security/index.md) says 8080 should only sit behind a reverse proxy, and not be published raw.

An operator who follows the install and security pages locks 8080 down and then shows offline on the dashboard, which is roughly what happened to the operator who asked. The troubleshooting page and the nginx-with-snapshots example already state the real requirement: the dashboard's plaintext probe has to reach /health on 8080, and the nginx example tells you to publish 8080 anyway if you want the online status. The two tables contradict all of that.

#429 landed the register-page guidance and #415 did the Host side, but the install and security tables still say the opposite.

• Pick the canonical rule and write it the same way in all three places.
• If the rule is that the probe needs plain HTTP on 8080, update the security page's recommendation column to say so, and lay out the tradeoff between the online status and a locked-down port.
• Update the install page's ports table to match.