Add novox.be; replace photos immich stub with the real app

- novox.be: owned www:latest container, public route novox.be
  (host 4000 -> app 8080). No DB, no secrets. Analog: de-spiegel/hello-web.
- photos: the existing module.json was a wrong immich stub (alpine image,
  port 2283). Replace it with the user's real photo app: photos-server
  backend consuming the mesh s3-bucket (bucket photos) + mongodb-database
  (db photos) providers, env templated from the provisions (analog:
  invoicing), plus the three static client containers (admin + two family
  sites). Only photos.novox.be is routed: contributes.route is single-valued
  across the catalog, so eef/filip need their own modules (flagged).

modules/novox.be/module.json

@@ -0,0 +1,50 @@
+{
+  "module": "novox.be",
+  "version": "1",
+  "capabilities": [
+    "container-runtime"
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "novox.be",
+      "port": 4000
+    }
+  },
+  "binds": {
+    "route": "/var/lib/novox.be/route.json"
+  },
+  "listens": [
+    {
+      "port": 4000,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the public website over http; the public name novox.be is a route grant, and route-proxy reaches it on this published port"
+    }
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "path": "/var/lib/novox.be",
+      "mode": "0700"
+    },
+    {
+      "id": "net",
+      "type": "network",
+      "name": "novox-be"
+    },
+    {
+      "id": "server",
+      "type": "container",
+      "name": "novox-be",
+      "image": "registry-api.novox.be/novox/www:latest",
+      "network": "novox-be",
+      "ports": [
+        "4000:8080"
+      ]
+    }
+  ]
+}