feat(cloudflared): wordeck.com + api.wordeck.com Ingress

Cards-zu-Wordeck-Rebrand: drei neue Hostnames ergänzt, alle auf
gleichem cards-web/cards-api Backend wie cardecky.mana.how.

- wordeck.com → :5181 (cards-web)
- www.wordeck.com → :5181
- api.wordeck.com → :3191 (cards-api)

Cloudflare-Tunnel-CNAMEs sind via API angelegt. cloudflared per
launchctl reloaded und smoke-tested. wordeck.com antwortet HTTP 200
mit Wordeck-Branding.

Siehe mana/docs/playbooks/WORDECK_REBRAND.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cloudflared-config.yml

@@ -18,6 +18,7 @@
 #
 # Removing a hostname: same steps, just delete the lines.
 #
+
 # Catch-all at the bottom returns http_status:404 for any hostname
 # Cloudflare routes here that we don't have an explicit ingress rule
 # for. This is the desired failure mode.
@@ -90,6 +91,12 @@ ingress:
   # landed. mana.how/cards still serves the in-mana cards module.
   - hostname: cardecky.mana.how
     service: http://localhost:5181
+  # wordeck.com — Cards-Rebrand (siehe mana/docs/playbooks/WORDECK_REBRAND.md, 2026-05-17).
+  # Zeigt auf denselben cards-web-Container wie cardecky.mana.how (port 5181).
+  - hostname: wordeck.com
+    service: http://localhost:5181
+  - hostname: www.wordeck.com
+    service: http://localhost:5181
   - hostname: storage.mana.how
     service: http://localhost:5000
   - hostname: presi.mana.how
@@ -194,6 +201,8 @@ ingress:
 
   - hostname: cardecky-api.mana.how
     service: http://localhost:3191
+  - hostname: api.wordeck.com
+    service: http://localhost:3191
   - hostname: feedback.mana.how
     service: http://localhost:3064
 
@@ -352,6 +361,17 @@ ingress:
   # because each Cloudflare DNS CNAME can only point at one tunnel.
 
   # ============================================
+
+  # Werdrobe — Digitaler Kleiderschrank + KI-Try-On (Code/werdrobe/).
+  # ~/projects/werdrobe/ on the Mac Mini.
+  # Ports per mana/docs/PORTS.md: 3097 api / 3098 web. Tier-Gate beta.
+  # Konsumiert mana-me, mana-image-edits, mana-media, mana-credits.
+  # DNS für werdrobe.com + api.werdrobe.com muss Till bei seinem .com-
+  # Registrar als CNAME auf den mana-tunnel zeigen lassen.
+  - hostname: werdrobe.com
+    service: http://localhost:3098
+  - hostname: api.werdrobe.com
+    service: http://localhost:3097
   # Catch-all (returns 404 for any unmapped hostname)
   # ============================================
   - service: http_status:404