Ten migration-critical modules become mesh-buildable (issue 060)

keycloak, mailu, minio, mongodb, mssql, nextcloud, portainer, redis,
umami and verdaccio get the Dockerfile + build section the eight
buildable modules already had; their runtime containers name the
artifact instead of a placeholder digest.

One convention, settled (060's open question, informed by 061): the
runtime container runs serve mode with every serve-time entrypoint in
MESH_TOOL_MODULES — tools serve, events flow, and a provider's
provisioner reconciles in the same process with the broker connected.
postgres, gitea and lavinmq are retrofitted from args-run provisioners,
which served no tools and emitted lifecycle events nowhere.

route-proxy is deferred: its build context is the mesh-controller
repository, a cross-repo shape the build section cannot yet express.

modules/postgres/Dockerfile

@@ -38,4 +38,4 @@ COPY --from=build /app/modules/postgres/dist /app/modules/postgres/dist
 # separate entrypoints because they are loaded by different things. The provisioner is the third,
 # and is not listed here — the declaration names it in the container's `args`, because it is what
 # this module's own container runs. One image, because they are one module and share a client.
-ENV MESH_TOOL_MODULES=/app/modules/postgres/dist/index.js,/app/modules/postgres/dist/tools/index.js
+ENV MESH_TOOL_MODULES=/app/modules/postgres/dist/index.js,/app/modules/postgres/dist/tools/index.js,/app/modules/postgres/dist/provisioner/index.js

modules/postgres/module.json

@@ -98,11 +98,7 @@
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_RECEIVES": "/var/lib/postgres/grants/mesh.json"
       },
-      "artifact": "runtime",
-      "args": [
-        "run",
-        "/app/modules/postgres/dist/provisioner/index.js"
-      ]
+      "artifact": "runtime"
     }
   ],
   "build": {