fix(dev): tenant-registry default port :8080 → :8090

Keycloak owns :8080 in the dev stack (docker-compose binds host:8080).
Running tenant-registry on the same port made 'make dev' refuse to
boot. Bump the default to :8090 across config, Makefile, Dockerfile,
.env.example, and README. ADDR env var still overrides if needed.

Production is unaffected — each service is in its own Orca container
with its own port-namespace.

Refs: M5.1 (unblocks portal local dev)

.env.example

@@ -0,0 +1,11 @@
+# tenant-registry — local dev environment.
+#
+# Copy to .env.local (gitignored) and edit. The service reads env vars
+# directly via internal/config; this file is just documentation.
+
+APP_ENV=dev
+ADDR=:8090
+KEYCLOAK_ISSUER=http://localhost:8080/realms/breakpilot-dev
+
+# Postgres DSN — unused by the skeleton (in-memory store). Wired up in M4.1.
+# DATABASE_URL=postgres://platform:platform-dev-pass@localhost:5432/platform?sslmode=disable

Dockerfile

@@ -11,5 +11,5 @@ FROM gcr.io/distroless/static-debian12:nonroot
 WORKDIR /
 COPY --from=build /out/tenant-registry /tenant-registry
 USER nonroot:nonroot
-EXPOSE 8080
+EXPOSE 8090
 ENTRYPOINT ["/tenant-registry"]

Makefile

@@ -2,7 +2,7 @@
 
 .PHONY: help dev test build fmt vet lint docker clean
 
-ADDR ?= :8080
+ADDR ?= :8090
 APP_ENV ?= dev
 
 help:

README.md

@@ -27,7 +27,7 @@ Multi-tenant glue: orgs, entitlements, API keys, audit. Scaffolded under milesto
 cd /path/to/platform/orca-platform && make dev-up
 
 # In another — run the service:
-make dev          # APP_ENV=dev, listens on :8080
+make dev          # APP_ENV=dev, listens on :8090 (Keycloak owns :8080 in the dev stack)
 make test         # unit tests
 make build        # compile to ./bin/tenant-registry
 ```
@@ -37,7 +37,7 @@ Env vars (override at the shell):
 | Var                | Default                                                      | Purpose                                |
 |---|---|---|
 | `APP_ENV`          | `dev`                                                        | one of `dev`, `stage`, `prod`          |
-| `ADDR`             | `:8080`                                                      | listen address                         |
+| `ADDR`             | `:8090`                                                      | listen address (avoids Keycloak's :8080) |
 | `KEYCLOAK_ISSUER`  | `http://localhost:8080/realms/breakpilot-dev`                | OIDC issuer URL                        |
 | `DATABASE_URL`     | empty (in-memory store in skeleton)                          | Postgres DSN, wired up in the M4.1 schema PR |
 
@@ -62,7 +62,7 @@ The skeleton's store is in-memory and pre-seeded with one tenant:
 }
 ```
 
-So `curl http://localhost:8080/v1/tenants/by-slug/acme` works the moment `make dev` is up.
+So `curl http://localhost:8090/v1/tenants/by-slug/acme` works the moment `make dev` is up.
 
 The full schema (tenants, tenant_products, audit_log) is committed at `migrations/0001_init.up.sql` for review, but unapplied until the M4.1 follow-up PR swaps the in-memory store for pgx-backed Postgres.
 
@@ -70,7 +70,7 @@ The full schema (tenants, tenant_products, audit_log) is committed at `migration
 
 | Env   | URL                                  | How                                  |
 |---|---|---|
-| dev   | `http://localhost:8080`          | `make dev`                           |
+| dev   | `http://localhost:8090`          | `make dev`                           |
 | stage | `https://tenant-registry.stage.breakpilot.com` | auto on merge to `main`         |
 | prod  | `https://tenant-registry.breakpilot.com`  | manual: tag `vX.Y.Z` + sign-off      |
 

internal/config/config.go

@@ -7,7 +7,7 @@ import (
 
 type Config struct {
 	Env            string // dev | stage | prod
-	Addr           string // listen address, e.g. ":8080"
+	Addr           string // listen address, e.g. ":8090"
 	KeycloakIssuer string // e.g. http://localhost:8080/realms/breakpilot-dev
 	DatabaseURL    string // postgres DSN (unused in skeleton; in-memory store)
 }
@@ -18,8 +18,9 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("invalid APP_ENV %q", env)
 	}
 	return &Config{
-		Env:            env,
-		Addr:           getenv("ADDR", ":8080"),
+		Env: env,
+		// :8090 — Keycloak owns :8080 in the dev stack.
+		Addr:           getenv("ADDR", ":8090"),
 		KeycloakIssuer: getenv("KEYCLOAK_ISSUER", "http://localhost:8080/realms/breakpilot-dev"),
 		DatabaseURL:    os.Getenv("DATABASE_URL"),
 	}, nil

internal/config/config_test.go

@@ -17,8 +17,8 @@ func TestLoad_defaults(t *testing.T) {
 	if cfg.Env != "dev" {
 		t.Errorf("Env = %q, want dev", cfg.Env)
 	}
-	if cfg.Addr != ":8080" {
-		t.Errorf("Addr = %q, want :8080", cfg.Addr)
+	if cfg.Addr != ":8090" {
+		t.Errorf("Addr = %q, want :8090", cfg.Addr)
 	}
 	if cfg.KeycloakIssuer == "" {
 		t.Error("KeycloakIssuer is empty; expected a default")