chore: change default UI port from 3000 to 42001

Update the default web UI port across all config, source, tests, and
documentation to use port 42001 instead of the Next.js default 3000.

Includes: .env.example, .env.local, Dockerfile, package.json scripts,
playwright config, protocol-fuzzer defaults, ~70 test mock URLs,
and all user-facing documentation references.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: SchenLong

README.md

@@ -38,7 +38,7 @@ cd DojoLM && npm install
 npm start --workspace=packages/bu-tpi    # API on :8089
 
 # Run the web UI
-npm run dev:web                           # UI on :3000
+npm run dev:web                           # UI on :42001
 
 # Run tests
 npm test                                  # 5,771 tests, 100% pass rate

docs/user/API_REFERENCE.md

@@ -6,7 +6,7 @@ NODA provides RESTful APIs for scanner operations, LLM testing, and platform man
 
 **Base URLs:**
 - Scanner API: `http://localhost:8089`
-- Web API: `http://localhost:3000/api`
+- Web API: `http://localhost:42001/api`
 
 **Authentication:**
 - API Key via `X-API-Key` header (for programmatic access)
@@ -138,7 +138,7 @@ Execute a single LLM test.
 
 **Request:**
 ```bash
-curl -X POST http://localhost:3000/api/llm/execute \
+curl -X POST http://localhost:42001/api/llm/execute \
   -H "Content-Type: application/json" \
   -H "X-API-Key: your-key" \
   -d '{
@@ -174,7 +174,7 @@ Execute batch LLM tests with SSE streaming.
 
 **Request:**
 ```bash
-curl -X POST http://localhost:3000/api/llm/batch \
+curl -X POST http://localhost:42001/api/llm/batch \
   -H "Content-Type: application/json" \
   -H "X-API-Key: your-key" \
   -d '{
@@ -199,7 +199,7 @@ curl -X POST http://localhost:3000/api/llm/batch \
 Stream batch progress via SSE.
 
 ```bash
-curl http://localhost:3000/api/llm/batch/uuid/stream
+curl http://localhost:42001/api/llm/batch/uuid/stream
 ```
 
 **Events:**
@@ -483,7 +483,7 @@ X-RateLimit-Reset: 1646745600
 import requests
 
 API_KEY = "your-api-key"
-BASE_URL = "http://localhost:3000/api"
+BASE_URL = "http://localhost:42001/api"
 
 def scan_text(text):
     response = requests.post(
@@ -501,7 +501,7 @@ print(result["verdict"])
 
 ```javascript
 const API_KEY = 'your-api-key';
-const BASE_URL = 'http://localhost:3000/api';
+const BASE_URL = 'http://localhost:42001/api';
 
 async function scanText(text) {
   const response = await fetch(`${BASE_URL}/scan`, {

docs/user/FAQ.md

@@ -29,7 +29,7 @@ Yes, Docker support is available:
 
 ```bash
 docker build -t dojolm:latest .
-docker run -p 3000:3000 -p 8089:8089 dojolm:latest
+docker run -p 42001:42001 -p 8089:8089 dojolm:latest
 ```
 
 ### How do I update NODA?

docs/user/GETTING_STARTED.md

@@ -34,7 +34,7 @@ npm run dev:web
 
 ### 4. Access NODA
 
-Open your browser to: `http://localhost:3000`
+Open your browser to: `http://localhost:42001`
 
 ## Your First Scan
 
@@ -120,16 +120,16 @@ Open your browser to: `http://localhost:3000`
 
 ```bash
 # Export all findings
-curl http://localhost:3000/api/ecosystem/findings/export
+curl http://localhost:42001/api/ecosystem/findings/export
 
 # Export high severity only
-curl "http://localhost:3000/api/ecosystem/findings/export?severity=8"
+curl "http://localhost:42001/api/ecosystem/findings/export?severity=8"
 ```
 
 ### Check System Health
 
 ```bash
-curl http://localhost:3000/api/admin/health
+curl http://localhost:42001/api/admin/health
 ```
 
 ### Scan via API

docs/user/PLATFORM_GUIDE.md

@@ -286,10 +286,10 @@ curl http://localhost:8089/api/stats
 
 ```bash
 # Export all findings
-curl http://localhost:3000/api/ecosystem/findings/export
+curl http://localhost:42001/api/ecosystem/findings/export
 
 # Filtered export
-curl "http://localhost:3000/api/ecosystem/findings/export?severity=high&format=json"
+curl "http://localhost:42001/api/ecosystem/findings/export?severity=high&format=json"
 ```
 
 ### Reports

github/CONTRIBUTING.md

@@ -28,7 +28,7 @@ dojolm/
 │   │   ├── fixtures/        # 2,375 attack/clean fixture files across 30 categories
 │   │   └── tools/           # Test suites
 │   ├── dojolm-scanner/      # Enhanced scanner package (web integration)
-│   ├── dojolm-web/          # Next.js web app (port 3000)
+│   ├── dojolm-web/          # Next.js web app (port 42001)
 │   └── bmad-cybersec/       # Multi-agent cybersecurity operations framework
 ├── docs/
 │   └── user/                # All public-facing documentation (this is where user docs live)

package-lock.json

@@ -89,6 +89,10 @@
     "./shingan": {
       "import": "./dist/shingan/index.js",
       "types": "./dist/shingan/index.d.ts"
+    },
+    "./validation": {
+      "import": "./dist/validation/index.js",
+      "types": "./dist/validation/index.d.ts"
     }
   },
   "bin": {
@@ -135,7 +139,8 @@
   },
   "dependencies": {
     "exifr": "7.1.3",
-    "music-metadata": "11.12.1"
+    "music-metadata": "11.12.1",
+    "zod": "3.24.4"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",

packages/bu-tpi/package.json

@@ -160,23 +160,23 @@ describe('createSelfPenTestConfig', () => {
   });
 
   it('creates valid config for localhost', () => {
-    const config = createSelfPenTestConfig('http://localhost:3000/api');
-    expect(config.targetUrl).toBe('http://localhost:3000/api');
+    const config = createSelfPenTestConfig('http://localhost:42001/api');
+    expect(config.targetUrl).toBe('http://localhost:42001/api');
     expect(config.testMode).toBe(true);
     expect(config.bypassGuard).toBe(true);
     expect(config.logResults).toBe(true);
     expect(config.maxTestDuration).toBe(300_000);
   });
 
   it('accepts 127.0.0.1', () => {
-    const config = createSelfPenTestConfig('http://127.0.0.1:3000');
-    expect(config.targetUrl).toBe('http://127.0.0.1:3000');
+    const config = createSelfPenTestConfig('http://127.0.0.1:42001');
+    expect(config.targetUrl).toBe('http://127.0.0.1:42001');
     expect(config.testMode).toBe(true);
   });
 
   it('accepts IPv6 loopback ::1', () => {
-    const config = createSelfPenTestConfig('http://[::1]:3000');
-    expect(config.targetUrl).toBe('http://[::1]:3000');
+    const config = createSelfPenTestConfig('http://[::1]:42001');
+    expect(config.targetUrl).toBe('http://[::1]:42001');
     expect(config.testMode).toBe(true);
   });
 
@@ -286,7 +286,7 @@ describe('evidence record production', () => {
   });
 
   it('self-pen config produces structured evidence', () => {
-    const evidence = createSelfPenTestConfig('http://localhost:3000');
+    const evidence = createSelfPenTestConfig('http://localhost:42001');
     expect(evidence).toHaveProperty('targetUrl');
     expect(evidence).toHaveProperty('testMode');
     expect(evidence).toHaveProperty('bypassGuard');

packages/bu-tpi/src/compliance/__tests__/llm-test-capabilities-h104.test.ts

@@ -36,7 +36,7 @@ export interface ProtocolFuzzConfig {
 
 export const DEFAULT_PROTOCOL_FUZZ_CONFIG: ProtocolFuzzConfig = {
   protocol: 'mcp',
-  targetUrl: 'http://localhost:3000',
+  targetUrl: 'http://localhost:42001',
   maxIterations: 1000,
   timeoutMs: 5000,
   mutationRate: 0.1,