simplify onboarding Step 3 port forwarding to clean static list

- Replace complex per-service/health-check UI with a clear, hardcoded
  table of required ports (80, 443, 22, 8448) and an optional Element
  Calling section (7881 TCP, 7882-7894 UDP, 5349 TCP, 3478 UDP,
  30000-40000 TCP/UDP).
- Add totals line: 4 openings without Element Calling, 9 with.
- Drop /api/ports/health fetch and all dynamic breakdowns (affected
  services loop, closed-port warnings, "View All Required Ports" table).
- Keep internal-IP display box, SSL-cert warning, and "How to set up
  port forwarding" collapsible section.
- Add prominent note that each port only needs to be forwarded once.
- Update Step 3 header description in onboarding.html to match.

Agent-Logs-Url: https://github.com/naturallaw777/staging_alpha/sessions/523e0770-f144-4f47-932b-c0d40782a35b

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>

app/sovran_systemsos_web/templates/onboarding.html

@@ -93,9 +93,8 @@
           <span class="onboarding-step-icon">🔌</span>
           <h2 class="onboarding-step-title">Port Forwarding Check</h2>
           <p class="onboarding-step-desc">
-            Your home router must forward specific ports to this machine before your services will work.
-            <strong>Ports 80 and 443 must be open before Caddy can authenticate your SSL certificates.</strong>
-            Without these ports forwarded, HTTPS will not work and your services will be unreachable from outside your network.
+            Forward these ports on your router to this machine. Each port only needs to be opened once — they are shared across all your services.
+            <strong>Ports 80 and 443 must be open for SSL certificates to work.</strong>
           </p>
         </div>
         <div class="onboarding-card onboarding-card--scroll" id="step-3-body">