Pin the internal auth port to the value nginx bound at startup (#23909)

/auth grants anonymous admin to any request whose X-Server-Port matches networking.listen.internal, but it read that port off the live config while nginx binds its listeners once at container start and never reloads them, so any path that swaps the running config could move the trusted port without nginx moving with it. Saving networking.listen.internal equal to the external port applied immediately despite the restart-required warning, which handed unauthenticated admin to everything reaching the external port. Snapshot the port at app creation and compare against that instead, and reject a config whose two listeners share a port number, which nginx would refuse to start with anyway.

frigate/config/network.py

@@ -1,10 +1,18 @@
-from pydantic import Field
+from pydantic import Field, model_validator
 
 from .base import FrigateBaseModel
 
 __all__ = ["IPv6Config", "ListenConfig", "NetworkingConfig"]
 
 
+def parse_listen_port(value: int | str) -> int:
+    """Return the port number from a bare port or an "address:port" value."""
+    if isinstance(value, str):
+        return int(value.split(":")[-1])
+
+    return value
+
+
 class IPv6Config(FrigateBaseModel):
     enabled: bool = Field(
         default=False,
@@ -25,6 +33,21 @@ class ListenConfig(FrigateBaseModel):
         description="External listening port for Frigate (default 8971).",
     )
 
+    @property
+    def internal_port(self) -> int:
+        return parse_listen_port(self.internal)
+
+    @property
+    def external_port(self) -> int:
+        return parse_listen_port(self.external)
+
+    @model_validator(mode="after")
+    def validate_distinct_ports(self) -> "ListenConfig":
+        if self.internal_port == self.external_port:
+            raise ValueError("internal and external must listen on different ports")
+
+        return self
+
 
 class NetworkingConfig(FrigateBaseModel):
     ipv6: IPv6Config = Field(