feat(infra): route events.mana.how + research.mana.how through tunnel

Two subdomains the webapp references in its SSR-injected config but
that had no tunnel entry:

- events.mana.how → mana-events on :3065. The container itself was
  also missing (defined in compose but never started); started
  today so the route now terminates somewhere real.
- research.mana.how → mana-research on :3068. The webapp was built
  with PUBLIC_MANA_RESEARCH_URL empty, which made research fetches
  fall back to mana.how and 404. The env-var side is still pending
  a rebuild, but the tunnel side is live now.

Cloudflare CNAMEs already created via `tunnel route dns`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -144,6 +144,10 @@ ingress:
     service: http://localhost:3002
   - hostname: subscriptions.mana.how
     service: http://localhost:3063
+  - hostname: events.mana.how
+    service: http://localhost:3065
+  - hostname: research.mana.how
+    service: http://localhost:3068
 
   # ============================================
   # Standalone web apps (separate containers)