Unreachable: find the broken layer before touching anything

Climb a fixed ladder of four tests — ss, curl on loopback, curl on the interface address, nc then curl from outside — and let the rung that breaks name the owner: the service, the bind, or the path.