chore(macmini): Föderations-Backbone + verein.mana.how + Nutriphi/Cardecky einspielen

Mac-Mini-Drift in Source-Control bringen — war seit 2026-05-08 live
auf dem Server, aber uncommitted (während des managarten-Renames via
stash gerettet).

Cloudflared-Tunnel:
- verein.mana.how → :3088 (Verein-Landing, live seit 2026-05-09)
- share.mana.how → :3072 (Föderations-Share-Service, Phase F)
- mcp.mana.how → :3069 (MCP-Gateway, exposing tool-registry)
- cardecky-api.mana.how → :3191 (Port-Korrektur, war fälschlich :3072)
- cardecky.mana.how → :5181 (Port-Korrektur, war :5180)
- nutriphi.mana.how → :3087, nutriphi-api.mana.how → :3086

docker-compose.macmini.yml:
- mana-auth CORS_ORIGINS: nutriphi.mana.how + nutriphi-api.mana.how
- Neuer Service mana-share (Build aus ../mana/services/mana-share,
  Föderations-Backbone Phase F, Port 3072, eigene DB-Tabellen in
  mana_platform)
- Neuer Service mana-mcp (Build aus ../mana/services/mana-mcp,
  MCP-Gateway, Port 3069)

Beide Services bauen aus dem mana-platform-Repo (../mana/services/...),
nicht aus managarten — managarten orchestriert nur via Compose.

cloudflared-config.yml

@@ -40,6 +40,8 @@ ingress:
   # the matching module surface. mana.how itself is the dashboard.
   - hostname: mana.how
     service: http://localhost:5000
+  - hostname: verein.mana.how
+    service: http://localhost:3088
   - hostname: chat.mana.how
     service: http://localhost:5000
   - hostname: todo.mana.how
@@ -60,7 +62,7 @@ ingress:
   # Was pointed at :5000 (the unified mana-web) until the standalone spinoff
   # landed. mana.how/cards still serves the in-mana cards module.
   - hostname: cardecky.mana.how
-    service: http://localhost:5180
+    service: http://localhost:5181
   - hostname: storage.mana.how
     service: http://localhost:5000
   - hostname: presi.mana.how
@@ -150,8 +152,14 @@ ingress:
     service: http://localhost:3063
   - hostname: events.mana.how
     service: http://localhost:3065
-  - hostname: cardecky-api.mana.how
+  # Föderations-Backbone (Phase F deployed 2026-05-08)
+  - hostname: share.mana.how
     service: http://localhost:3072
+  - hostname: mcp.mana.how
+    service: http://localhost:3069
+
+  - hostname: cardecky-api.mana.how
+    service: http://localhost:3191
   - hostname: feedback.mana.how
     service: http://localhost:3064
 
@@ -201,6 +209,14 @@ ingress:
   - hostname: zitare-api.mana.how
     service: http://localhost:3083
 
+  # Nutriphi (Code/nutriphi, separate repo)
+  # ~/projects/nutriphi/ on the Mac Mini.
+  # Ports per mana/docs/PORTS.md: 3086 api / 3087 web.
+  - hostname: nutriphi.mana.how
+    service: http://localhost:3087
+  - hostname: nutriphi-api.mana.how
+    service: http://localhost:3086
+
   # ============================================
   # Standalone web apps (separate containers)
   # ============================================

docker-compose.macmini.yml

@@ -250,7 +250,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how
     ports:
       - "3001:3001"
     healthcheck:
@@ -386,6 +386,64 @@ services:
   # public photon.komoot.io and Nominatim as last-resort fallbacks.
   # See services/mana-geocoding/CLAUDE.md for provider-chain details.
   # Internal-only: no traefik labels, not exposed via Cloudflare.
+
+  # ─── Föderations-Backbone (mana-share + mana-mcp) ──────────────
+  # Built aus Plattform-Repo (../mana/services/...). Phase F (Föderation)
+  # 2026-05-08 nach Live-Cardecky deployed — vorher nur lokal lauffähig.
+
+  mana-share:
+    build:
+      context: ../mana
+      dockerfile: services/mana-share/Dockerfile
+    image: mana-share:local
+    container_name: mana-share
+    restart: always
+    mem_limit: 192m
+    depends_on:
+      postgres: { condition: service_healthy }
+    environment:
+      TZ: Europe/Berlin
+      PORT: 3072
+      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-mana123}@postgres:5432/mana_platform
+      MANA_AUTH_URL: http://mana-auth:3001
+      MANA_SERVICE_KEY: ${MANA_SERVICE_KEY}
+      CORS_ORIGINS: https://mana.how,https://cardecky.mana.how
+    ports:
+      - "3072:3072"
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:3072/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 120s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+  mana-mcp:
+    build:
+      context: ../mana
+      dockerfile: services/mana-mcp/Dockerfile
+    image: mana-mcp:local
+    container_name: mana-mcp
+    restart: always
+    mem_limit: 192m
+    depends_on:
+      postgres: { condition: service_healthy }
+      mana-share: { condition: service_started }
+    environment:
+      TZ: Europe/Berlin
+      PORT: 3069
+      DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-mana123}@postgres:5432/mana_platform
+      MANA_AUTH_URL: http://mana-auth:3001
+      MANA_SERVICE_KEY: ${MANA_SERVICE_KEY}
+      CORS_ORIGINS: https://mana.how,https://cardecky.mana.how
+      MANA_SHARE_URL: http://mana-share:3072
+    ports:
+      - "3069:3069"
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:3069/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 120s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
   mana-geocoding:
     build:
       context: services/mana-geocoding