`--tailscale` re-picks a port held by a foreground `tailscale serve`/`funnel` session and never starts

Symptom

With PORTLESS_TAILSCALE=1 (or --tailscale), portless fails to start when another process holds a Tailscale HTTPS port through a foreground session, and the auto-assign retry never recovers:

Error: Tailscale HTTPS port 443 is already in use. Stop the existing serve or let portless auto-assign a different port.

The message suggests auto-assign, but auto-assign is exactly what ran: findAvailableServePort() picked 443 on every retry because getUsedServePorts() never saw it as taken.

Cause

getUsedServePorts() reads only the top-level Web and TCP maps of tailscale serve status --json. Sessions created with tailscale serve / tailscale funnel without --bg are reported under a separate Foreground key, one entry per session, each with its own Web/TCP (and AllowFunnel) maps. Ports held there are just as unavailable, but portless treats them as free.

Trimmed real output, with a background serve on 8443 and a foreground funnel on 443 owned by another tool:

{
  "TCP": { "8443": { "HTTPS": true } },
  "Web": {
    "devbox.example.ts.net:8443": { "Handlers": { "/": { "Proxy": "http://127.0.0.1:7317" } } }
  },
  "Foreground": {
    "df16b397a48601e8": {
      "TCP": { "443": { "HTTPS": true } },
      "Web": {
        "devbox.example.ts.net:443": { "Handlers": { "/": { "Proxy": "http://127.0.0.1:51458" } } }
      },
      "AllowFunnel": { "devbox.example.ts.net:443": true }
    }
  }
}

getUsedServePorts() returns {8443} for that input; 443 is chosen, tailscale serve --bg --https=443 reports a conflict, and the retry loop repeats the same computation until the process gives up.

Environment

portless 0.15.5 and 0.15.6 (main at time of filing still has no Foreground handling in getUsedServePorts), macOS, Tailscale 1.102.2. The foreground session in our case is held by another local gateway that runs tailscale funnel without --bg.

Proposed fix

Walk each Foreground session's Web/TCP maps with the same parsing as the top level. #403 carries that change plus a test; reopening it alongside this issue.