feat(core): reserved-port and API-key guardrails in the default system prompt (#24)

Co-authored-by: Alice <alice@prismshadow.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

packages/cli/test/serve.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { Command } from "commander";
+import { DEFAULT_SERVER_PORT } from "@prismshadow/penguin-core";
 import {
   DEFAULT_HOST,
   DEFAULT_PORT,
@@ -11,6 +12,9 @@ import {
 import { getMessages } from "../src/i18n.js";
 
 describe("resolvePort (option > env var > default 7364)", () => {
+  it("derives DEFAULT_PORT from core's DEFAULT_SERVER_PORT", () => {
+    expect(DEFAULT_PORT).toBe(DEFAULT_SERVER_PORT);
+  });
   it("uses the default 7364 when neither is given", () => {
     expect(DEFAULT_PORT).toBe(7364);
     expect(resolvePort(undefined, undefined)).toBe(7364);