docs(roadmap): port collision handling verified structurally impossible

Services never claim host ports (PortMappings never populated — traffic
routes via container IPs + Traefik), databases bind ephemeral ports on
127.0.0.1, and any future conflict already surfaces as a failed
deployment carrying Docker's bind error. Nothing to build without a
service-level port config surface.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP.md

@@ -230,8 +230,13 @@ pieces exist; this phase closes the gaps that block real usage.
       transitional state so build → deploy propagates to nodes, deployment
       history rows link straight into that deployment's log tail, and rollback
       asks for confirmation before firing.
-- [ ] **Node/port collision handling**: two services claiming the same host
+- [x] **Node/port collision handling**: verified structurally impossible in the
-      port must produce a clear error, not a silent failure.
+      current model — services never claim host ports (`PortMappings` is never
+      populated; traffic routes via container IPs + Traefik discovery), and
+      managed databases bind `127.0.0.1` with ephemeral host ports. If a claim
+      ever conflicts, Docker's bind error lands in `deployments.error` and shows
+      in the failed-deploy log tail — not silent. Revisit if a service-level
+      host-port config is ever added.
 - [ ] Auth hardening: e2e verify bootstrap gate (first user registers, second
       is refused, manual creation works), OAuth happy paths for GitHub +
       Google, session expiry redirect.