Ten migration-critical modules become mesh-buildable (issue 060)

keycloak, mailu, minio, mongodb, mssql, nextcloud, portainer, redis,
umami and verdaccio get the Dockerfile + build section the eight
buildable modules already had; their runtime containers name the
artifact instead of a placeholder digest.

One convention, settled (060's open question, informed by 061): the
runtime container runs serve mode with every serve-time entrypoint in
MESH_TOOL_MODULES — tools serve, events flow, and a provider's
provisioner reconciles in the same process with the broker connected.
postgres, gitea and lavinmq are retrofitted from args-run provisioners,
which served no tools and emitted lifecycle events nowhere.

route-proxy is deferred: its build context is the mesh-controller
repository, a cross-repo shape the build section cannot yet express.

modules/postgres/module.json

@@ -98,11 +98,7 @@
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_RECEIVES": "/var/lib/postgres/grants/mesh.json"
       },
-      "artifact": "runtime",
-      "args": [
-        "run",
-        "/app/modules/postgres/dist/provisioner/index.js"
-      ]
+      "artifact": "runtime"
     }
   ],
   "build": {