novox conversions: give the web apps public names through route-proxy

Add a `route` contribution (requires/contributes/binds) to every web app so
each gets a Host-routed public name via route-proxy, mirroring the
de-spiegel/only-office pattern:

- novox: gitea, keycloak, nextcloud, umami, invoicing, verdaccio, registry,
  and mailu (single mail.novox.be -> 7080; admin/webmail/api ride that port).
- ace: grafana, sonarr, radarr, lidarr, bazarr, ombi, tautulli, jackett,
  nodered, searxng, home-assistant, bookshelf, baserow.

Split photos so its three sites each get a name: photos keeps server +
admin-client (photos.novox.be), and new photos-eef (eef.novox.be) and
photos-filip (filip.novox.be) modules carry the client sites.

The production FQDN stays the literal default; a per-node .incus name is a
settings override applied where the mesh runs, not a manifest hardcoding.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/umami/module.json

@@ -5,15 +5,21 @@
     "container-runtime"
   ],
   "requires": [
-    "postgres-database"
+    "postgres-database",
+    "route"
   ],
   "contributes": {
     "postgres-database": {
       "name": "umami"
+    },
+    "route": {
+      "name": "umami.novox.be",
+      "port": 3000
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/umami/database.json"
+    "postgres-database": "/var/lib/umami/database.json",
+    "route": "/var/lib/umami/route.json"
   },
   "secrets": {
     "postgres-database": "/var/lib/umami/database.secret"
@@ -43,7 +49,7 @@
       "port": 3000,
       "protocol": "tcp",
       "from": "anywhere",
-      "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to — so the port itself must be reachable from anywhere"
+      "why": "one port serves two surfaces: the dashboard (the proxy gates it to the mesh) and the public collection endpoint that the browsers of every tracked site POST to \u2014 so the port itself must be reachable from anywhere"
     }
   ],
   "resources": [