Apps listen on 88xx by default; production install terminates TLS on the bundled proxy at :443. GM is the sole token issuer, plus MCP/Agent permission scope.