nexus node one, stage 4 placeholder: this host will serve the portfolio service and the broker read endpoints the Vercel pages call (session-bound and service-signed).