#3913 Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

swamp serve now accepts --trusted-hosts entries of the form host:port (swamp-club#3892, swamp PR #3366). The manual still describes the flag only as hostnames for Host header validation when binding off-loopback.

Pages to update:

• content/manual/reference/swamp-serve/serve-flags.md: the --trusted-hosts row and the paragraph after the flag table.
• content/manual/reference/swamp-serve/daemon.md: the --trusted-hosts mention.

Suggested content:

• An entry is a hostname or host:port. It applies to the Host header check, the browser Origin check for WebSocket upgrades and no-auth HTTP APIs, and the dashboard sign-in (session) check.
• A bare hostname trusts that host's browser origin on any port for WebSocket and no-auth checks, but means port 443 for dashboard sign-in.
• A host:port entry trusts only that exact browser origin. When the public address uses a non-default port (for example tailscale serve --https=9443, browser origin https://<public-host>:9443), list it as <public-host>:9443; that one entry passes both the WebSocket and dashboard sign-in checks.
• The Host header check compares hostnames only, so both forms trust the entry's hostname there.
• The same applies to a plain-HTTP proxy on a port other than 80.