Allow proxy to auto-assign free ports for sessions

[paddybyers]

Summary

• Make the port field optional in POST /sessions. When omitted or set to 0, the proxy binds to an OS-assigned free port via net.Listen("tcp", ":0").
• Eliminates the TOCTOU race where callers had to guess which ports were available — the proxy now assigns a guaranteed-free port.
• Fully backwards-compatible: callers that pass an explicit positive port see identical behavior.

Changes

• listener.go: StartSessionListener returns (int, error), extracts actual port from listener address, sets session.Port under mutex.
• server.go: Validation changed from port <= 0 to port < 0. Uses returned actualPort for response and logging.
• session.go: Added omitempty to CreateSessionRequest.Port json tag.
• docs/API.md: port documented as optional with auto-assign behavior.
• proxy_test.go: Updated validation test for negative port; added TestSessionAutoPort.

Test plan

• go build ./... compiles cleanly
• go test ./... — all 27 tests pass
• New TestSessionAutoPort verifies auto-assigned port is valid and listening
• Existing tests with explicit ports still pass (backwards compatibility)
• Manual smoke test: create session without port, verify response contains auto-assigned port

🤖 Generated with Claude Code