f1-circuits: become a nox mesh module

The mesh builds the CDN from this repository and a commit (novox/hq ADR
0069); registry-api.novox.be, where HAL's image came from, is retired, so
the running container can no longer be re-pulled. The HAL module.yml and
service/docker-compose.yml retire with HAL.

The Kometa metadata links every poster to this service's own address,
which was the literal https://f1-circuits.zurag.be. It is now
F1_CIRCUITS_BASE_URL, written by the mesh from the route's name
(${bound:route:name}, mesh-controller #149) - falling back to the old
address, so HAL's deployment behaves as before. The tile user agent
follows it.

The poster cache is a placed directory mounted at /app/cache, as HAL's
/services/f1-circuits/cache was. The image was built from unpinned pip
installs; service/requirements.txt now pins the exact set the running
container has (pip freeze), and the base is python 3.12.13-alpine3.24 by
digest (a later alpine 3.24 patch than the running build's 3.24.0 - the
older digest is no longer tagged). The slug "f1" keeps the route login
within 20 characters on any machine.

Verified: the manifest parses on mesh-controller main and #149 and
renders for a zurag.be node (F1_CIRCUITS_BASE_URL=https://f1-circuits.
zurag.be). Built from this commit and run on an empty cache: /circuits,
/circuits/<country> and a rendered Spa track are byte-identical to what
ace serves today; the base URL comes from the variable, and without it
falls back to the old address.

Depends on mesh-controller #149.

module.json

@@ -0,0 +1,82 @@
+{
+  "module": "f1-circuits",
+  "slug": "f1",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "label": "f1-circuits",
+      "endpoint": "web"
+    }
+  },
+  "binds": {
+    "route": "${dir:state}/route.json"
+  },
+  "listens": [
+    {
+      "name": "web",
+      "port": 8000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the track-layout CDN, the race posters and the Kometa metadata over http; its public name is a route grant and the proxy reaches it here. Kometa fetches the metadata and every poster by that public name"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "cache",
+      "type": "directory",
+      "mode": "0700"
+    },
+    {
+      "id": "site-env",
+      "type": "file",
+      "path": "${dir:state}/site.env",
+      "mode": "0644",
+      "content": "F1_CIRCUITS_BASE_URL=https://${bound:route:name}\n"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "f1-circuits",
+      "artifact": "cdn",
+      "ports": [
+        "8000"
+      ],
+      "env-file": [
+        "${dir:state}/site.env"
+      ],
+      "volumes": [
+        "${dir:cache}:/app/cache"
+      ],
+      "restart-on": [
+        "site-env"
+      ]
+    }
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "PYTHON_BASE",
+        "image": "python@sha256:6d43704baacd1bfbe7c295d7f13079d5d8104ed33568873133f8fc69980419df"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "cdn",
+        "kind": "image",
+        "from": "service/Dockerfile"
+      }
+    ]
+  }
+}