fix(monitoring): photon via Cloudflare-Tunnel, drop dead whopxl

Two cleanups against the status-page DOWN list:

photon-self (photon.mana.how route):
  mana-geocoding's /health/photon-self pings the photon backend, which
  lives as a Docker container on the GPU-Box (port 2322). PHOTON_SELF_API_URL
  was http://192.168.178.11:2322 — Mini-host can hit that fine but
  Mini-Docker-containers can't (Colima-NAT-quirk we keep running into).
  Routed photon through the mana-gpu-server tunnel (config v26) and
  flipped the env var to https://photon.mana.how. Probe goes UP, geocoding
  for sensitive queries (privacy:'local' provider tier) actually works
  now too — was effectively orphaned before.

whopxl removed everywhere it still lingered:
  Container hasn't existed on the Mini in months (no compose service,
  no source dir under apps/, no listener on :5100 — only the dead
  cloudflared route + a stale CORS_ORIGINS entry on mana-auth). Cleaned
  cloudflared-config.yml, prometheus.yml blackbox-web target, and the
  mana-auth CORS list. Old DNS CNAME for whopxl.mana.how stays for now;
  no harm.

Plus while we were here: who-api.mana.how/api/decks was the right probe
for who-server's deck catalogue (root /api/decks lives on who-api, not
who.mana.how which is the SSR shell).

Live: status.mana.how shows 58/59 UP; the last 'whopxl' entry will
fall off after VM's TSDB rolls past the probe_success staleness window.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docker-compose.macmini.yml

@@ -250,7 +250,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cards.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://cards.mana.how
     ports:
       - "3001:3001"
     healthcheck:
@@ -460,10 +460,12 @@ services:
     environment:
       TZ: Europe/Berlin
       PORT: 3018
-      # Self-hosted Photon on mana-gpu (cross-LAN). When set, registers
-      # as `photon-self` provider with privacy: 'local' — eligible for
-      # sensitive queries. Empty value = slot disabled.
-      PHOTON_SELF_API_URL: ${PHOTON_SELF_API_URL:-}
+      # Self-hosted Photon. Läuft als Docker-Container auf der GPU-Box
+      # (mana-server-gpu, WSL2). Mini-Container können die GPU-LAN-IP
+      # nicht direkt routen (Colima-NAT-Quirk), daher via Cloudflare-
+      # Tunnel — `photon.mana.how` schickt direkt an den GPU-tunnel.
+      # Empty value = slot disabled.
+      PHOTON_SELF_API_URL: ${PHOTON_SELF_API_URL:-https://photon.mana.how}
       # Cold-start cross-LAN fetches to photon-self consistently take
       # >10s on the first probe; the 8s default false-marked it unhealthy
       # on every cold path. 20s leaves headroom while still cutting off