feat(infra): Primary-Switch herbatrium.com + seepuls.com

- herbatrium.mana.how + herbatrium-api.mana.how raus aus cloudflared
  und mana-auth CORS_ORIGINS — nur noch herbatrium.com /
  api.herbatrium.com.
- Seepuls vom .mana.how- auf .com-Setup gewechselt: cloudflared
  exposed jetzt seepuls.com (apex + www) und api.seepuls.com (statt
  seepuls.mana.how + seepuls-api.mana.how).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -283,14 +283,15 @@ ingress:
     service: http://localhost:3196
 
   # Seepuls (Event-Aggregator Konstanz/Kreuzlingen, DE+CH) — Code/seepuls.
-  # ~/projects/seepuls/ on the Mac Mini (Deploy pending, Phase β-4).
-  # Ports per mana/docs/PORTS.md: 3095 api / 3096 web. Aggregator-App,
-  # gilt mana/docs/AGGREGATOR_POLICY.md (robots.txt-Pflicht, sichtbare
-  # Attribution, Take-Down ≤ 72h). DNS vorgemerkt, Service liefert 502
-  # bis Container deployed ist.
-  - hostname: seepuls.mana.how
+  # ~/projects/seepuls/ on the Mac Mini. Ports per mana/docs/PORTS.md:
+  # 3095 api / 3096 web. Aggregator-App, gilt mana/docs/AGGREGATOR_POLICY.md
+  # (robots.txt-Pflicht, sichtbare Attribution, Take-Down ≤ 72h).
+  # 2026-05-20 Primary-Switch auf seepuls.com (.mana.how abgeschaltet).
+  - hostname: seepuls.com
     service: http://localhost:3096
-  - hostname: seepuls-api.mana.how
+  - hostname: www.seepuls.com
+    service: http://localhost:3096
+  - hostname: api.seepuls.com
     service: http://localhost:3095
 
   # ============================================
@@ -408,12 +409,7 @@ ingress:
   # Herbatrium — Citizen-Science-Pflanzenbeobachtungen (Code/herbatrium/).
   # Host-Ports 3103+3104 (statt 3101+3102) wegen memoro-audio-Konflikt
   # auf 3101. Service-interne Ports bleiben 3101+3000 per PORTS.md.
-  # 2026-05-20 Co-Domain herbatrium.com + api.herbatrium.com hinzugefügt
-  # (kein Primary-Switch, herbatrium.mana.how bleibt funktional).
-  - hostname: herbatrium.mana.how
-    service: http://localhost:3104
-  - hostname: herbatrium-api.mana.how
-    service: http://localhost:3103
+  # 2026-05-20 Primary-Switch auf herbatrium.com (.mana.how abgeschaltet).
   - hostname: herbatrium.com
     service: http://localhost:3104
   - hostname: api.herbatrium.com

docker-compose.macmini.yml

@@ -248,7 +248,7 @@ services:
       # Enforced by services/mana-auth/src/auth/sso-config.spec.ts.
       # All productivity modules now live under mana.how (path-based) —
       # no per-module subdomain entries required here.
-      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.com,https://app.zitare.com,https://api.zitare.com,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.mana.how,https://herbatrium-api.mana.how,https://herbatrium.com,https://api.herbatrium.com,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
+      CORS_ORIGINS: https://mana.how,https://auth.mana.how,https://whopxl.mana.how,https://cardecky.mana.how,https://cardecky-api.mana.how,https://wordeck.com,https://api.wordeck.com,https://memoro-app.mana.how,https://zitare.com,https://app.zitare.com,https://api.zitare.com,https://zitare-api.mana.how,https://nutriphi.mana.how,https://nutriphi-api.mana.how,https://manawald.mana.how,https://werdrobe.com,https://api.werdrobe.com,https://pageta.mana.how,https://pageta-api.mana.how,https://pageta.com,https://api.pageta.com,https://herbatrium.com,https://api.herbatrium.com,https://moodlit.mana.how,https://moodlit-api.mana.how,https://comicello.com,https://api.comicello.com,https://comicello.mana.how,https://comicello-api.mana.how,https://uload-api.mana.how,https://ulo.ad,https://mukke.mana.how,https://mukke-api.mana.how,https://manaclick.mana.how
     ports:
       - "3001:3001"
     healthcheck: