Onboarding: --listen override and auto-pick free port; live TLS demo verified

src/onboard.rs

@@ -13,6 +13,7 @@ pub async fn run(
     reader: &mut impl BufRead,
     writer: &mut impl Write,
     config_path: &Path,
+    listen_override: Option<&str>,
 ) -> Result<()> {
     writeln!(writer, "FRX onboarding")?;
     writeln!(
@@ -150,7 +151,10 @@ pub async fn run(
     }
     let data_dir = prompt(writer, reader, "data directory", "./frx-data")?;
 
-    let mut config = Config::new(&id, "127.0.0.1:7701", relays.clone(), &data_dir);
+    let listen = listen_override
+        .map(str::to_string)
+        .unwrap_or_else(|| pick_listen("127.0.0.1:7701"));
+    let mut config = Config::new(&id, &listen, relays.clone(), &data_dir);
     config.node.id = Some(id.clone());
     config.node.registry = Some(registry.clone());
     config.node.ma_key = Some(ma_key.clone());
@@ -180,6 +184,7 @@ pub async fn run(
     writeln!(writer, "  config: {}", config_path.display())?;
     writeln!(writer, "  registry: {registry}")?;
     writeln!(writer, "  relays: {}", relays.join(", "))?;
+    writeln!(writer, "  listening: {listen}")?;
     writeln!(
         writer,
         "Next: frxd serve, then frx query \"...\" to broadcast."
@@ -228,6 +233,14 @@ fn parse_block(block: &str) -> Result<Credentials> {
     })
 }
 
+fn pick_listen(preferred: &str) -> String {
+    if std::net::TcpListener::bind(preferred).is_ok() {
+        return preferred.to_string();
+    }
+    let fallback = std::net::TcpListener::bind("127.0.0.1:0").expect("bind ephemeral port");
+    fallback.local_addr().expect("local addr").to_string()
+}
+
 fn registry_base(registry_url: &str) -> String {
     match registry_url.rfind('/') {
         Some(index) => registry_url[..index].to_string(),