fix(monitoring): photon via Cloudflare-Tunnel, drop dead whopxl

Two cleanups against the status-page DOWN list:

photon-self (photon.mana.how route):
  mana-geocoding's /health/photon-self pings the photon backend, which
  lives as a Docker container on the GPU-Box (port 2322). PHOTON_SELF_API_URL
  was http://192.168.178.11:2322 — Mini-host can hit that fine but
  Mini-Docker-containers can't (Colima-NAT-quirk we keep running into).
  Routed photon through the mana-gpu-server tunnel (config v26) and
  flipped the env var to https://photon.mana.how. Probe goes UP, geocoding
  for sensitive queries (privacy:'local' provider tier) actually works
  now too — was effectively orphaned before.

whopxl removed everywhere it still lingered:
  Container hasn't existed on the Mini in months (no compose service,
  no source dir under apps/, no listener on :5100 — only the dead
  cloudflared route + a stale CORS_ORIGINS entry on mana-auth). Cleaned
  cloudflared-config.yml, prometheus.yml blackbox-web target, and the
  mana-auth CORS list. Old DNS CNAME for whopxl.mana.how stays for now;
  no harm.

Plus while we were here: who-api.mana.how/api/decks was the right probe
for who-server's deck catalogue (root /api/decks lives on who-api, not
who.mana.how which is the SSR shell).

Live: status.mana.how shows 58/59 UP; the last 'whopxl' entry will
fall off after VM's TSDB rolls past the probe_success staleness window.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker/prometheus/prometheus.yml

@@ -276,7 +276,6 @@ scrape_configs:
           - https://mana.how/mail
           - https://mana.how/playground
           # ─── Standalone Apps / Games (separate Container, eigene Tunnel-Hostnames) ───
-          - https://whopxl.mana.how
           - https://manavoxel.mana.how
           # Memoro Standalone-Stack (Phase 2 mana e.V. Plattform-Migration)
           - https://memoro.mana.how
@@ -307,7 +306,7 @@ scrape_configs:
           - https://memoro-api.mana.how/health
           - https://memoro-audio.mana.how/health
           # who.mana.how API on /api/decks — root is 404 by design (Phaser-Cantina mounts at /cantina)
-          - https://who.mana.how/api/decks
+          - https://who-api.mana.how/api/decks
           # Verein backoffice (mana e.V. Plattform); only /health returns 200, root is auth-walled
           - https://admin.mana.how/health
     relabel_configs: