fix: wire dynamic port allocation through docker-compose.yml

docker-compose.yml had hardcoded port literals (e.g. "5432:5432") so
ailegal.sh's dynamic port allocation was silently ignored - ports:auto
would reassign env vars but Compose always bound to defaults. Replace
all 11 host-side ports with ${VAR:-default}:container_port so exported
env vars actually take effect.

Also fix container ownership detection: ensure_dynamic_ports and
cmd_ports built container names from PORT_LABELS (e.g. mike-minio_api-1)
instead of the actual Compose service name (mike-minio-1), causing
multi-port services to always show CONFLICT. Add PORT_SERVICES array
mapping each port label to its Docker service name.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>