The rest of the catalogue becomes mesh-buildable (issue 060, batch 2)

The 21 media/home modules, the SaaS tool modules (cloudflare-dns,
confluence, gitlab, jira), model-usage, and the model-access trio get
the same Dockerfile + build section as batch 1. Scheduled-only modules
(anthropic-consumer, anthropic-manager, openai-consumer) deliberately
declare no MESH_TOOL_MODULES — every container of theirs names its
command. mosquitto's run-once bootstrap container builds from the same
artifact. Modules with third-party deps (model-usage: pg;
anthropic-manager: tweetnacl) install them beside their compiled code.

Also fixes cloudflare-dns's package.json, unparseable since its
description lost a closing quote.

Deliberately still without build sections: builder and mesh-controller
(the foundation builds them by its own path), distribution (provides
the artifact store — building it through itself is refused by design),
route-proxy (cross-repo build context, deferred), and the
upstream-image-only modules, which have no code to build.

modules/unifi/module.json

@@ -15,7 +15,7 @@
       "port": 8080,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "device inform — how APs and switches check in and are adopted"
+      "why": "device inform \u2014 how APs and switches check in and are adopted"
     },
     {
       "port": 3478,
@@ -27,7 +27,7 @@
       "port": 10001,
       "protocol": "udp",
       "from": "mesh",
-      "why": "device discovery — the controller finds unadopted devices on the network"
+      "why": "device discovery \u2014 the controller finds unadopted devices on the network"
     },
     {
       "port": 1902,
@@ -113,7 +113,6 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-unifi",
-      "image": "mesh-runtime-unifi@sha256:0000000000000000000000000000000000000000000000000000000000000000",
       "network": "host",
       "volumes": [
         "/var/lib/mesh/unifi/broker:/run/secrets/broker:ro",
@@ -126,10 +125,32 @@
       },
       "restart-on": [
         "runtime-config"
-      ]
+      ],
+      "artifact": "runtime"
     }
   ],
   "own-secrets": {
     "broker": "/var/lib/mesh/unifi/broker"
+  },
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
   }
 }