novox conversions: give the web apps public names through route-proxy

Add a `route` contribution (requires/contributes/binds) to every web app so
each gets a Host-routed public name via route-proxy, mirroring the
de-spiegel/only-office pattern:

- novox: gitea, keycloak, nextcloud, umami, invoicing, verdaccio, registry,
  and mailu (single mail.novox.be -> 7080; admin/webmail/api ride that port).
- ace: grafana, sonarr, radarr, lidarr, bazarr, ombi, tautulli, jackett,
  nodered, searxng, home-assistant, bookshelf, baserow.

Split photos so its three sites each get a name: photos keeps server +
admin-client (photos.novox.be), and new photos-eef (eef.novox.be) and
photos-filip (filip.novox.be) modules carry the client sites.

The production FQDN stays the literal default; a per-node .incus name is a
settings override applied where the mesh runs, not a manifest hardcoding.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/nodered/module.json

@@ -74,5 +74,17 @@
         "runtime-config"
       ]
     }
-  ]
+  ],
+  "requires": [
+    "route"
+  ],
+  "contributes": {
+    "route": {
+      "name": "nodered.zurag.be",
+      "port": 1880
+    }
+  },
+  "binds": {
+    "route": "/var/lib/mesh/nodered/route.json"
+  }
 }