Pi bundle: Kvitt on port 443 through NPM (D-124)

KVITT_PUBLIC_URL=https://${KVITT_PUBLIC_HOST} with no port; the health check
through NPM prints the port-less URL; publish-apk.sh's summary drops :8443.
README: no new router rule (the existing external 443 forward to the Home
Assistant Pi serves Kvitt, NPM selects by name), NPM listens on 443, the
fallback, operations and APK-abuse notes, and every :8443 URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/lib.sh

@@ -6,7 +6,8 @@
 KVITT_DIR=${KVITT_DIR:-/opt/kvitt}
 # The server's port, published on the Pi's LAN interfaces; Nginx Proxy Manager forwards to it (D-120).
 SERVER_URL=http://localhost:8080
-# Nginx Proxy Manager's HTTPS port on the Home Assistant Pi (the router forwards external 8443 to it, D-120).
+# Nginx Proxy Manager's HTTPS port on the Home Assistant Pi, the default HTTPS port that Kvitt's public URL uses
+# (the router's existing external 443 forward reaches it, D-124).
 NPM_HTTPS_PORT=443
 
 say() { printf '%s\n' "$*"; }
@@ -76,11 +77,11 @@ print_proxy_health() {
   local out ha_host host
   ha_host=$(env_value HA_HOST)
   host=$(env_value KVITT_PUBLIC_HOST)
-  if out=$(curl -fsS --max-time 15 --resolve "$host:$NPM_HTTPS_PORT:$ha_host" "https://$host:$NPM_HTTPS_PORT/health" 2>&1); then
-    say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host): $out"
+  if out=$(curl -fsS --max-time 15 --resolve "$host:$NPM_HTTPS_PORT:$ha_host" "https://$host/health" 2>&1); then
+    say "GET https://$host/health (via NPM at $ha_host:$NPM_HTTPS_PORT): $out"
     return 0
   fi
-  say "GET https://$host:$NPM_HTTPS_PORT/health (via NPM at $ha_host) failed: $out"
+  say "GET https://$host/health (via NPM at $ha_host:$NPM_HTTPS_PORT) failed: $out"
   return 1
 }