Let Xray pick standard 443 or a custom listen port (v3.1.2).

Default to custom 8443 so 443 stays free unless the user chooses standard.

Co-authored-by: Cursor <cursoragent@cursor.com>

managers/xray_manager.py

@@ -26,7 +26,7 @@ class XrayManager:
     PROTOCOL = 'xray'
     CONTAINER_NAME = 'amnezia-xray'
     IMAGE_NAME = 'amneziavpn/amnezia-xray'
-    DEFAULT_PORT = 443
+    DEFAULT_PORT = 8443
 
     def __init__(self, ssh_manager, protocol='xray'):
         self.ssh = ssh_manager
@@ -298,13 +298,15 @@ chmod 644 {_q(self._cert_path())} {_q(self._key_path())}
         stream = (inbound or {}).get('streamSettings') or {}
         return str(stream.get('security') or '').lower() == 'reality'
 
-    def install_protocol(self, port=443, domain=None, email=None, site_name=None,
+    def install_protocol(self, port=8443, domain=None, email=None, site_name=None,
                          acme_method='cloudflare', cloudflare_token=None):
         """Install VLESS + XHTTP + TLS (Let's Encrypt via Cloudflare DNS or HTTP-01)."""
         results = []
         domain = self._validate_domain(domain or site_name)
         email = self._validate_email(email)
         port = int(port or self.DEFAULT_PORT)
+        if port < 1 or port > 65535:
+            raise ValueError('Port must be between 1 and 65535')
         method = (acme_method or 'cloudflare').strip().lower()
         if method in ('cf', 'dns', 'dns-01', 'cloudflare_dns'):
             method = 'cloudflare'