feat(infra): app.zitare.com + api.zitare.com ingress, zitare.mana.how raus

- cloudflared-config.yml: app.zitare.com → :3084, api.zitare.com →
  :3083 ergänzt. zitare.mana.how-Block entfernt. zitare-api.mana.how
  bleibt als Back-Compat. Kommentar-Header aktualisiert.
- docker-compose.macmini.yml: mana-auth CORS_ORIGINS — zitare.mana.how
  + zitare-api.mana.how raus, zitare.com + app.zitare.com +
  api.zitare.com + zitare-api.mana.how (Back-Compat) rein.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -236,16 +236,17 @@ ingress:
 
   # ============================================
   # Zitare (Code/zitare, separate repo)
-  # ~/projects/zitare-deploy/ on the Mac Mini (planned — Phase 1.6).
+  # Stand 2026-05-20: zitare.com ist die kanonische Brand-Domain.
+  # zitare.mana.how ist abgeschaltet, zitare-api.mana.how bleibt als
+  # Back-Compat-Surface für externe Tooling.
   # Ports per mana/docs/PORTS.md: 3083 api / 3084 app / 3085 com.
-  # zitare.com is a separate Cloudflare zone; tunnel route for that
-  # hostname must be added via `cloudflared tunnel route dns
-  # 1435166a-0e3f-4222-8de6-744f32cea5c9 zitare.com` (one-time).
   # ============================================
   - hostname: zitare.com
     service: http://localhost:3085
-  - hostname: zitare.mana.how
+  - hostname: app.zitare.com
     service: http://localhost:3084
+  - hostname: api.zitare.com
+    service: http://localhost:3083
   - hostname: zitare-api.mana.how
     service: http://localhost:3083
 

docker-compose.macmini.yml

@@ -248,7 +248,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.com,https://app.zitare.com,https://api.zitare.com,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
     ports:
       - "3001:3001"
     healthcheck: