feat(infra): ulo.ad path-routing, uload.mana.how raus

- cloudflared-config.yml: ulo.ad mit Pfad-Regex /r|api|public|healthz|
  readyz|\.well-known → :3107, sonst → :3108. uload.mana.how-Block raus.
- docker-compose.macmini.yml: mana-auth CORS_ORIGINS — uload.mana.how
  raus.
- package.json + lock: yaml als root-devDep (scripts/validate-cloudflared-
  config.mjs importiert es direkt, lief sonst nicht ohne Hoisting).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -115,8 +115,6 @@ ingress:
     service: http://localhost:5000
   - hostname: times.mana.how
     service: http://localhost:5000
-  - hostname: uload.mana.how
-    service: http://localhost:3108
   - hostname: context.mana.how
     service: http://localhost:5000
   - hostname: questions.mana.how
@@ -172,8 +170,14 @@ ingress:
   # ============================================
   - hostname: uload-api.mana.how
     service: http://localhost:3107
+  # ulo.ad serviert die Web-UI direkt (kanonisch seit 2026-05-20).
+  # Path-Routing: API-Pfade gehen an :3107, alles andere an SvelteKit :3108.
+  # Reihenfolge zählt — spezifische Regeln zuerst.
   - hostname: ulo.ad
+    path: ^/(r|api|public|healthz|readyz|\.well-known)(/.*)?$
     service: http://localhost:3107
+  - hostname: ulo.ad
+    service: http://localhost:3108
   - hostname: media.mana.how
     service: http://localhost:3011
   - hostname: llm.mana.how

docker-compose.macmini.yml

@@ -248,7 +248,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.mana.how,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
     ports:
       - "3001:3001"
     healthcheck:

package.json

@@ -239,7 +239,8 @@
 		"turbo": "^2.3.0",
 		"typescript": "^5.9.3",
 		"typescript-eslint": "^8.48.1",
-		"wrangler": "^4.51.0"
+		"wrangler": "^4.51.0",
+		"yaml": "^2.8.3"
 	},
 	"engines": {
 		"node": ">=18.0.0"