feat: dedicated ports per panel tier (8880/8881/8882)

Each panel now has its own dedicated port and is fully self-contained:
- Port 8880: User panel (end-user hosting dashboard)
- Port 8881: Reseller panel (account/package management)
- Port 8882: Admin panel (datacenter/server manager)

Changes:
- install.sh: PORT_USER/PORT_RESELLER/PORT_ADMIN constants; three separate
  nginx/Apache vhosts; UFW opens all three ports; Fail2Ban jail per port;
  credentials file shows all three URLs
- config.ini: stores port_user/port_reseller/port_admin
- Core.php: defines PORT_USER/RESELLER/ADMIN, detects CURRENT_PORTAL from
  SERVER_PORT so the API knows which tier is being accessed
- Auth.php: portalUrl() maps role → correct port for cross-portal redirects
- auth.php endpoint: returns portal_url on login so JS redirects to right port
- index.php login: uses portal_url from API response (no hardcoded paths)
- admin/index.php: inline login form (port 8882 is self-contained, no redirect)
- user/index.php: inline login form (port 8880 self-contained)
- reseller/index.php: new full reseller panel with inline login (port 8881);
  sidebar with accounts, packages, DNS, branding, bandwidth report sections

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/lib/Auth.php

@@ -97,4 +97,19 @@ class Auth {
             Response::error('Forbidden', 403);
         }
     }
+
+    /**
+     * Returns the correct panel URL for a given role
+     * Used by login redirect so each role lands on the right port
+     */
+    public static function portalUrl(string $role, string $path = '/'): string {
+        $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
+        $hostname = preg_replace('/:\d+$/', '', $host);
+        $port = match($role) {
+            'admin'    => PORT_ADMIN,
+            'reseller' => PORT_RESELLER,
+            default    => PORT_USER,
+        };
+        return "https://{$hostname}:{$port}{$path}";
+    }
 }