novox conversions: give the web apps public names through route-proxy

Add a `route` contribution (requires/contributes/binds) to every web app so
each gets a Host-routed public name via route-proxy, mirroring the
de-spiegel/only-office pattern:

- novox: gitea, keycloak, nextcloud, umami, invoicing, verdaccio, registry,
  and mailu (single mail.novox.be -> 7080; admin/webmail/api ride that port).
- ace: grafana, sonarr, radarr, lidarr, bazarr, ombi, tautulli, jackett,
  nodered, searxng, home-assistant, bookshelf, baserow.

Split photos so its three sites each get a name: photos keeps server +
admin-client (photos.novox.be), and new photos-eef (eef.novox.be) and
photos-filip (filip.novox.be) modules carry the client sites.

The production FQDN stays the literal default; a per-node .incus name is a
settings override applied where the mesh runs, not a manifest hardcoding.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/baserow/module.json

@@ -6,16 +6,22 @@
   ],
   "requires": [
     "postgres-database",
-    "redis-cache"
+    "redis-cache",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "baserow"
+    },
+    "route": {
+      "name": "baserow.zurag.be",
+      "port": 80
     }
   },
   "binds": {
     "postgres-database": "/var/lib/baserow/database.json",
-    "redis-cache": "/var/lib/baserow/redis.json"
+    "redis-cache": "/var/lib/baserow/redis.json",
+    "route": "/var/lib/baserow/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/baserow/database.secret",