fix(port, session): harden port registry and fix concurent allocation (#155)

Critical fixes to the port registry that prevented correct tunnel port allocation under concurrency and allowed out-of-range ports to be claimed.

Bug Fixes:
- Fixed AddRange infinite loop when endPort == 65535 (uint16 wraparound)
 -Fixed Claim bypassing the allowed range — now rejects out-of-range ports
- Fixed Unassigned handing out the same port to concurrent callers — now reserves atomically
- Fixed SetStatus silently creating entries for unknown ports — now returns an error

Reviewed-on: #155
Co-authored-by: Bagas <bagas@fossy.my.id>
Co-committed-by: Bagas <bagas@fossy.my.id>

internal/port/port.go

@@ -33,10 +33,15 @@ func (pm *port) AddRange(startPort, endPort uint16) error {
 	if startPort > endPort {
 		return fmt.Errorf("start port cannot be greater than end port")
 	}
-	for index := startPort; index <= endPort; index++ {
-		if _, exists := pm.ports[index]; !exists {
-			pm.ports[index] = false
-			pm.sortedPorts = append(pm.sortedPorts, index)
+	for index := startPort; ; index++ {
+		if index != 0 {
+			if _, exists := pm.ports[index]; !exists {
+				pm.ports[index] = false
+				pm.sortedPorts = append(pm.sortedPorts, index)
+			}
+		}
+		if index == endPort {
+			break
 		}
 	}
 	sort.Slice(pm.sortedPorts, func(i, j int) bool {
@@ -51,6 +56,7 @@ func (pm *port) Unassigned() (uint16, bool) {
 
 	for _, index := range pm.sortedPorts {
 		if !pm.ports[index] {
+			pm.ports[index] = true
 			return index, true
 		}
 	}
@@ -61,6 +67,9 @@ func (pm *port) SetStatus(port uint16, assigned bool) error {
 	pm.mu.Lock()
 	defer pm.mu.Unlock()
 
+	if _, exists := pm.ports[port]; !exists {
+		return fmt.Errorf("port %d is not in the allowed range", port)
+	}
 	pm.ports[port] = assigned
 	return nil
 }
@@ -70,16 +79,10 @@ func (pm *port) Claim(port uint16) (claimed bool) {
 	defer pm.mu.Unlock()
 
 	status, exists := pm.ports[port]
-
-	if exists && status {
+	if !exists || status {
 		return false
 	}
 
-	if !exists {
-		pm.ports[port] = true
-		return true
-	}
-
 	pm.ports[port] = true
 	return true
 }