Read port forwards from per-VM forwards.conf files

A QEMU config file section cannot hold more than one hostfwd entry, so
the forwards move out of the ini files into qemu/<vm>/forwards.conf, one
"LABEL HOST_PORT GUEST_PORT" rule per line. The new vmforwards.py parses
them, skips rules whose host port is taken and builds the -netdev
argument, which every launcher now passes instead of relying on a
netdev section in the ini or on -nic.

The ini files move to qemu/<vm>/config.ini and qemu/<vm>/<os>-<arch>.ini.
The *_SSH_PORT / *_RDP_PORT variables and --rdp-port / --ssh-port still
replace the host port of the SSH and RDP rules.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -26,12 +26,12 @@ original qcow2 image as its backing file. The base image therefore stays
 unchanged. Run `./run-debian13.py --help` for the supported environment
 variables.
 
-The Debian VM hardware (8G memory, 8 CPUs, drives, network) is
-defined in the QEMU config file `qemu/debian13.ini`; the machine type and
-architecture-specific devices are in `qemu/debian13-<os>-<arch>.ini`
+The Debian VM hardware (8G memory, 8 CPUs, drives) is
+defined in the QEMU config file `qemu/debian13/config.ini`; the machine type and
+architecture-specific devices are in `qemu/debian13/<os>-<arch>.ini`
 (os `linux` or `darwin`, arch `amd64` or `arm64`), together with the
 accelerators. Edit these files to change the settings. The
-launcher fills in the `${...}` file path placeholders of `qemu/debian13.ini`,
+launcher fills in the `${...}` file path placeholders of `qemu/debian13/config.ini`,
 writes the result to `vm/debian13/qemu.ini` and starts QEMU with
 `-readconfig` for that file followed by the one for the host system and guest architecture.
 QEMU arguments given after `--` override the config files, for example
@@ -122,9 +122,9 @@ On the first boot, cloud-init updates package metadata and installs Fedora's
 GNOME package group through its native package module, then reboots the guest.
 Keep the VM running until this initial installation and reboot have completed.
 
-Like the Debian VM, the Fedora VM hardware (8G memory, 8 CPUs, drives, SSH
-port `2224`) is defined in `qemu/fedora44.ini`, with the accelerators, machine type and
-platform-specific devices in `qemu/fedora44-<os>-<arch>.ini`. Other Fedora settings use the `FEDORA_VM_` prefix.
+Like the Debian VM, the Fedora VM hardware (8G memory, 8 CPUs, drives) is
+defined in `qemu/fedora44/config.ini`, with the accelerators, machine type and
+platform-specific devices in `qemu/fedora44/<os>-<arch>.ini`. Other Fedora settings use the `FEDORA_VM_` prefix.
 Run `./run-fedora44.py --help` for the complete list of overrides.
 
 ## Ubuntu 26.04
@@ -150,9 +150,9 @@ On the first boot, cloud-init installs `ubuntu-desktop-minimal` (GNOME) and
 guest. Keep the VM running until this initial installation and reboot have
 completed.
 
-The VM hardware (8G memory, 8 CPUs, drives, SSH port `2225`) is defined in
-`qemu/ubuntu2604.ini`, with the accelerators, machine type and platform-specific
-devices in `qemu/ubuntu2604-<os>-<arch>.ini`. Other Ubuntu
+The VM hardware (8G memory, 8 CPUs, drives) is defined in
+`qemu/ubuntu2604/config.ini`, with the accelerators, machine type and platform-specific
+devices in `qemu/ubuntu2604/<os>-<arch>.ini`. Other Ubuntu
 settings use the `UBUNTU_VM_` prefix. Run `./run-ubuntu2604.py --help` for the
 complete list of overrides.
 
@@ -182,10 +182,10 @@ seed ISO also carries the host's SSH public key (`$SSH_PUBLIC_KEY_FILE`, else th
 first of `~/.ssh/id_ed25519.pub`, `id_ecdsa.pub`, `id_rsa.pub`) for passwordless
 administrator login.
 The Windows VM hardware (8G memory, 8 CPUs, system disk, devices)
-is defined in `qemu/windows11.ini`, with the accelerators and machine type in
-`qemu/windows11-<os>-<arch>.ini`; the launcher renders the former to
+is defined in `qemu/windows11/config.ini`, with the accelerators and machine type in
+`qemu/windows11/<os>-<arch>.ini`; the launcher renders the former to
 `vm/windows11/qemu.ini` and loads both with `-readconfig`. Only the network
-and the installation media are still set by the launcher. QEMU arguments after
+(see Port forwards) and the installation media are still set by the launcher. QEMU arguments after
 `--` override the config files, for example `./run-windows11.py -- -m 4G -smp 4`.
 The generated answer-file ISO is stored beside the disk as
 `vm/windows11/seed.iso`.
@@ -202,3 +202,24 @@ is elsewhere:
 ```bash
 WIN11_VM_TOOLS_ISO=/custom/path/virtio-win.iso ./run-windows11.py --install-from-iso
 ```
+
+## Port forwards
+
+The host ports forwarded to the guest are not in the QEMU config files (a
+config file section cannot hold more than one `hostfwd`) but in one file per
+VM, `qemu/<vm>/forwards.conf`, which the launcher turns into the `-netdev`
+argument. Each line is `LABEL HOST_PORT GUEST_PORT`; `#` starts a comment:
+
+```
+# qemu/windows11/forwards.conf
+RDP  3389  3389
+SSH  2222  22
+```
+
+Add a line to forward another port. A rule whose host port is already in use
+is skipped with a warning. `ALMA_VM_FORWARDS`, `FEDORA_VM_FORWARDS`,
+`UBUNTU_VM_FORWARDS`, `VM_FORWARDS` (Debian) and `WIN11_VM_FORWARDS` select
+another file. `ALMA_VM_SSH_PORT`, `WIN11_VM_RDP_PORT`, `WIN11_VM_SSH_PORT`
+and `--rdp-port`/`--ssh-port` still replace the host port of the rule with the
+label `SSH` or `RDP`. The launchers import `vmforwards.py` from the repository
+root.