fix(portal-bff): use the real portal-admin dev port (4300) in admin-flow references

PR #129 baked `4201` into a few comments and test fixtures as the
admin SPA's dev port. The actual port wired in
`apps/portal-admin/project.json` `serve.options.port` is `4300` — the
Nx serve target listens on 4300 in dev. Aligning the references so a
contributor reading `.env.example` or the test fixtures sees the same
number their browser is hitting.

Touched:
- `apps/portal-bff/.env.example` — `ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI`
  default + the surrounding comment.
- `apps/portal-bff/src/config/check-cors-allowlist.ts` — stale
  doc-comment that pre-dated the portal-admin scaffolding.
- `auth.module.spec.ts`, `auth.controller.spec.ts`,
  `auth.service.spec.ts`, `admin-auth.controller.spec.ts`,
  `check-entra-config.spec.ts` — fixture `adminPostLogoutRedirectUri`
  values. Tests don't depend on the port; aligned for clarity only.

No behaviour change. 278 specs still pass.

apps/portal-bff/.env.example

@@ -67,9 +67,10 @@ ENTRA_POST_LOGOUT_REDIRECT_URI=http://localhost:4200/
 # session. Both `ENTRA_REDIRECT_URI` and `ENTRA_ADMIN_REDIRECT_URI`
 # must be registered in the same Entra app registration's
 # "Redirect URIs" list. Distinct post-logout URL routes admin
-# sign-outs to the admin SPA's landing page (port 4201 in dev).
+# sign-outs to the admin SPA's landing page (port 4300 in dev — see
+# apps/portal-admin/project.json `serve.options.port`).
 ENTRA_ADMIN_REDIRECT_URI=http://localhost:3000/api/admin/auth/callback
-ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=http://localhost:4201/
+ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=http://localhost:4300/
 
 # Cookie signing secret (per ADR-0009 §"Cookies"). Used to sign the
 # transient pre-auth cookie that carries the OIDC `state` + PKCE