feat: freeze ssh and vnc port contracts

Define the minimum machine networking surface for the next host slice and
limit exposed guest ports to SSH and VNC.

contract/machines.go

@@ -3,15 +3,16 @@ package host
 import "time"
 
 type Machine struct {
-	ID             MachineID    `json:"id"`
-	Artifact       ArtifactRef  `json:"artifact"`
-	SystemVolumeID VolumeID     `json:"system_volume_id,omitempty"`
-	UserVolumeIDs  []VolumeID   `json:"user_volume_ids,omitempty"`
-	Phase          MachinePhase `json:"phase"`
-	RuntimeHost    string       `json:"runtime_host,omitempty"`
-	Error          string       `json:"error,omitempty"`
-	CreatedAt      time.Time    `json:"created_at"`
-	StartedAt      *time.Time   `json:"started_at,omitempty"`
+	ID             MachineID     `json:"id"`
+	Artifact       ArtifactRef   `json:"artifact"`
+	SystemVolumeID VolumeID      `json:"system_volume_id,omitempty"`
+	UserVolumeIDs  []VolumeID    `json:"user_volume_ids,omitempty"`
+	RuntimeHost    string        `json:"runtime_host,omitempty"`
+	Ports          []MachinePort `json:"ports,omitempty"`
+	Phase          MachinePhase  `json:"phase"`
+	Error          string        `json:"error,omitempty"`
+	CreatedAt      time.Time     `json:"created_at"`
+	StartedAt      *time.Time    `json:"started_at,omitempty"`
 }
 
 type CreateMachineRequest struct {

contract/networking.go

@@ -0,0 +1,20 @@
+package host
+
+type MachinePortName string
+
+type PortProtocol string
+
+const (
+	MachinePortNameSSH MachinePortName = "ssh"
+	MachinePortNameVNC MachinePortName = "vnc"
+)
+
+const (
+	PortProtocolTCP PortProtocol = "tcp"
+)
+
+type MachinePort struct {
+	Name     MachinePortName `json:"name"`
+	Port     uint16          `json:"port"`
+	Protocol PortProtocol    `json:"protocol"`
+}