Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

ansible/roles/base/defaults/main.yml

@@ -58,3 +58,9 @@ flannel_vxlan_allowed_sources: []
 #     proto: tcp
 #     comment: "nydus-ex-api dashboard agent"
 ufw_extra_allowed: []
+
+# Ports 80/443 are separate from generic exceptions. They stay empty for a new
+# reef unless the controller supplies reef_declaration_path and that source
+# declaration carries exact ADR-0008 substrate grants.
+public_web_ports: []
+reef_declaration_path: ""