/**
 * Ask the OS for a free loopback port by binding port 0 and releasing it.
 *
 * Sessions used to share one fixed port, so a leftover server held it and the
 * next session lost token refresh (dequelabs/axe-mcp-server#1013). The OS
 * never hands out a port something is still bound to.
 *
 * It is released before the child binds it, so another process could take it
 * in between. That window is not small: it spans minting a token against
 * Keycloak and starting the child. Because the port was not the user's
 * choice, losing it degrades the session to no token refresh rather than
 * failing it (see `portWasAutoSelected` in `runSession`).
 *
 * Nothing proves the listener on that port is our child, so a process that
 * takes it receives whatever is pushed there. Tracked in #1028.
 */
export default function findFreePort(host?: string): Promise<number>;