fix(config_flow): always retry historically-confirmed DTLS ports (#192)

The liveness sweep's ICMP-based verdict isn't trustworthy on every network
path -- a segregated-VLAN report showed it calling three closed ports live
while missing the one port a concurrent nmap scan found genuinely
open|filtered, which also happened to be one of our two historically
confirmed DTLS ports. Rather than trust a "not live" verdict against that
prior, always give PREFERRED_PROBE_PORTS a real handshake attempt even when
the sweep excludes them, bounded to at most those two extra attempts.

This is a stop-gap for the reported failure mode, not a full fix for the
sweep's underlying unreliability -- left a comment on the issue with the
diagnosis and flagged the sweep itself for a deeper redesign.

custom_components/localthings/config_flow.py

@@ -194,7 +194,17 @@ def _find_live_ports(host: str, ports: list[int], timeout: float) -> list[int]:
             except OSError:
                 pass
 
-    return _order_candidates(live)
+    # The sweep's ICMP-based verdict isn't reliable on every network path --
+    # issue #192 captured a segregated-VLAN device where it called three
+    # ports live that a concurrent nmap scan showed as closed, while the
+    # port nmap found genuinely open|filtered (49154, one of our historically
+    # confirmed ports) never showed up as live at all. Rather than trust a
+    # wrong "not live" verdict on a port we already have strong prior
+    # evidence for, always give the historically-confirmed ports a real
+    # handshake attempt too. Bounded cost: at most len(PREFERRED_PROBE_PORTS)
+    # extra handshakes, only when the sweep disagrees with the prior.
+    rescued = [p for p in PREFERRED_PROBE_PORTS if p in ports and p not in live]
+    return _order_candidates(live + rescued)
 
 
 def _is_placeholder_serial(serial: str) -> bool: