novox conversions: give the web apps public names through route-proxy

Add a `route` contribution (requires/contributes/binds) to every web app so
each gets a Host-routed public name via route-proxy, mirroring the
de-spiegel/only-office pattern:

- novox: gitea, keycloak, nextcloud, umami, invoicing, verdaccio, registry,
  and mailu (single mail.novox.be -> 7080; admin/webmail/api ride that port).
- ace: grafana, sonarr, radarr, lidarr, bazarr, ombi, tautulli, jackett,
  nodered, searxng, home-assistant, bookshelf, baserow.

Split photos so its three sites each get a name: photos keeps server +
admin-client (photos.novox.be), and new photos-eef (eef.novox.be) and
photos-filip (filip.novox.be) modules carry the client sites.

The production FQDN stays the literal default; a per-node .incus name is a
settings override applied where the mesh runs, not a manifest hardcoding.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/photos/module.json

@@ -85,26 +85,6 @@
       "ports": [
         "4001:80"
       ]
-    },
-    {
-      "id": "eef-client",
-      "type": "container",
-      "name": "photos-client-eef",
-      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "network": "photos",
-      "ports": [
-        "4002:80"
-      ]
-    },
-    {
-      "id": "filip-client",
-      "type": "container",
-      "name": "photos-client-filip",
-      "image": "registry-api.novox.be/novox/photos-client:latest",
-      "network": "photos",
-      "ports": [
-        "4003:80"
-      ]
     }
   ]
 }