infra(cloudflared): add stats.mana.how ingress → localhost:3118

The mana-stats service (stats.mana.how + mana-ev.ch/zahlen source) had no
tunnel ingress rule in the committed config — root/healthz/api all 404'd
even though mana-stats is healthy on :3118. Add the rule before the 404
catch-all. DNS already points at the tunnel.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -483,4 +483,9 @@ ingress:
   - hostname: chor.mana.how
     service: http://localhost:3091
 
+  # mana-stats — öffentliche Transparenz-Stats (stats.mana.how + mana-ev.ch/zahlen).
+  # Host-Port 3118; DNS via `cloudflared tunnel route dns` auf den Tunnel gezeigt.
+  - hostname: stats.mana.how
+    service: http://localhost:3118
+
   - service: http_status:404