RustFS console port collides with Herd's internal API port (9001), corrupting nginx configs with raw AccessDenied XML

**Environment:** Herd for Windows, RustFS service v1.0.0.89

**Summary:**
Enabling the RustFS service breaks every site on the machine with a 500 error, because RustFS's console/dashboard port collides with Herd's own internal API port.

**Root cause:**
- Herd's internal API (`config.json` -> `apiPort`) defaults to `9001`.
- RustFS's console/dashboard address is derived as `mainPort + 1` (seen in Herd's own app bundle: `--console-address`, `port + 1`). With RustFS's default main port `9000`, its console also binds `9001`.
- No collision check exists between the two, so whichever service actually wins the bind, some internal HTTP calls meant for Herd's own API land on RustFS's console instead. RustFS replies with a generic S3 `403 AccessDenied` XML body, and Herd inserts that raw response verbatim into config values -- including nginx's `fastcgi_index`, `fastcgi_param SCRIPT_FILENAME`, `error_page 404`, and even CLI output like `herd links`' PHP Version column and `herd --version`.
- This corruption gets re-written every time a site's nginx config regenerates (changing PHP version, `herd secure`/`unsecure`, etc.), so it doesn't self-heal -- the port collision is still live.

**Steps to reproduce:**
1. Enable the RustFS service in Herd (Windows).
2. Restart Herd / trigger any nginx config regeneration (change PHP version, secure/unsecure a site, etc.).
3. Visit any site -- get a raw nginx 500.
4. Check the site's generated `.conf` in `%USERPROFILE%\.config\herd\config\valet\Nginx\.conf` -- `fastcgi_index`/`SCRIPT_FILENAME`/etc. contain the literal string `AccessDeniedAccess Denied` instead of the real PHP entry-script path.
5. `herd --version` and `herd links`' PHP Version column show the same AccessDenied XML string instead of a version number.

**Nginx error log evidence:**
```
[crit] CreateFile() "C:<" failed (123: The filename, directory name, or volume label syntax is incorrect) ...
```

**Workaround:** manually edit `services.json` to move RustFS off port 9000/9001 (e.g. to 9010, so its console lands on 9011), restart Herd, then re-run `herd secure ` to force nginx config regeneration.

**Suggested fix:** either randomize/offset RustFS's default port away from Herd's own `apiPort`, add an explicit collision check on startup, or -- more robustly -- validate that internal API responses look like the expected shape before writing them into generated config files (don't blindly trust/write raw HTTP error bodies into config values).

Reproduce the collision by checking config.json's apiPort, services.json, and the generated %USERPROFILE%\.config\herd\config\valet\Nginx\.conf after enabling RustFS and regenerating nginx configuration. Compare the affected herd --version and herd links output with the raw AccessDenied response; done means the port collision or unsafe response handling no longer corrupts nginx configuration or CLI output.

Written by the indexing model from the issue text.