beam-orchestrator host (WCP is a separate TLS TCP port, not proxied here)