fix(infra): relocate mana-ai from 3066 to 3067 — port clash with news-ingester

news-ingester already owns 3066 (see docker-compose.macmini.yml:1620).
Moving mana-ai to 3067 — the next free slot in the 306x services block
(credits 3061, user 3062, subscriptions 3063, analytics 3064,
events 3065, news-ingester 3066, mana-ai 3067).

Updated: Dockerfile EXPOSE + HEALTHCHECK, config.ts default,
compose service/healthcheck/port mapping, webapp getManaAiUrl()
fallback, root CLAUDE.md service list, mana-ai/CLAUDE.md, and
COMPANION_BRAIN_ARCHITECTURE.md §20 file map.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -33,7 +33,7 @@ docs/                # Long-form docs (deployment, hardware, postmortems, etc.)
 
 ### Active services (`services/`)
 
-`mana-auth` (3001), `mana-sync` (3050), `mana-credits`, `mana-user`, `mana-subscriptions`, `mana-analytics`, `mana-search` (3021), `mana-crawler`, `mana-api-gateway`, `mana-notify`, `mana-media`, `mana-llm`, `mana-image-gen`, `mana-video-gen`, `mana-stt`, `mana-tts`, `mana-voice-bot`, `mana-events`, `mana-geocoding` (3018), `mana-landing-builder`, `mana-ai` (3066, background AI Mission Runner — see [`services/mana-ai/CLAUDE.md`](services/mana-ai/CLAUDE.md)). Each non-trivial service has its own `CLAUDE.md`.
+`mana-auth` (3001), `mana-sync` (3050), `mana-credits`, `mana-user`, `mana-subscriptions`, `mana-analytics`, `mana-search` (3021), `mana-crawler`, `mana-api-gateway`, `mana-notify`, `mana-media`, `mana-llm`, `mana-image-gen`, `mana-video-gen`, `mana-stt`, `mana-tts`, `mana-voice-bot`, `mana-events`, `mana-geocoding` (3018), `mana-landing-builder`, `mana-ai` (3067, background AI Mission Runner — see [`services/mana-ai/CLAUDE.md`](services/mana-ai/CLAUDE.md)). Each non-trivial service has its own `CLAUDE.md`.
 
 ## Coding Guidelines
 

apps/mana/apps/web/src/lib/api/config.ts

@@ -69,9 +69,9 @@ export function getManaAiUrl(): string {
 	if (browser && typeof window !== 'undefined') {
 		const injected = (window as unknown as { __PUBLIC_MANA_AI_URL__?: string })
 			.__PUBLIC_MANA_AI_URL__;
-		return injected || 'http://localhost:3066';
+		return injected || 'http://localhost:3067';
 	}
-	return process.env.PUBLIC_MANA_AI_URL || 'http://localhost:3066';
+	return process.env.PUBLIC_MANA_AI_URL || 'http://localhost:3067';
 }
 
 /**

docker-compose.macmini.yml

@@ -319,7 +319,7 @@ services:
     environment:
       TZ: Europe/Berlin
       NODE_ENV: production
-      PORT: 3066
+      PORT: 3067
       SYNC_DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD:-mana123}@postgres:5432/mana_sync
       MANA_LLM_URL: http://mana-llm:3020
       MANA_SERVICE_KEY: ${MANA_SERVICE_KEY}
@@ -330,9 +330,9 @@ services:
       # Absent → all grants skip silently with reason="not-configured".
       MANA_AI_PRIVATE_KEY_PEM: ${MANA_AI_PRIVATE_KEY_PEM:-}
     ports:
-      - "3066:3066"
+      - "3067:3067"
     healthcheck:
-      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:3066/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      test: ["CMD", "bun", "-e", "fetch('http://127.0.0.1:3067/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 120s
       timeout: 10s
       retries: 3

docs/architecture/COMPANION_BRAIN_ARCHITECTURE.md

@@ -1794,7 +1794,7 @@ Code:
     stempelt `__lastActor` + `__fieldActors` aus eingehenden Changes
     → **cross-device Attribution geschlossen**
 - [x] Schritt 9 — Server-side `mana-ai` Bun-Service (v0.3, Close-the-Loop)
-  - `services/mana-ai/` — Hono/Bun auf Port 3066
+  - `services/mana-ai (3067
   - `@mana/shared-ai` Package als Single-Source-of-Truth für Planner-
     Prompt + Parser + Typen (Webapp + Service importieren identisch)
   - Field-level LWW-Replay von `sync_changes` in `db/missions-projection.ts`

services/mana-ai/CLAUDE.md

@@ -8,7 +8,7 @@ Design context: [`docs/architecture/COMPANION_BRAIN_ARCHITECTURE.md` §20](../..
 
 What works end-to-end:
 
-- [x] Boots as a Hono/Bun service on port `3066`
+- [x] Boots as a Hono/Bun service on port `3067`
 - [x] Exposes `/health` and service-key-gated `/internal/tick`
 - [x] Replays `sync_changes` for `appId='ai' / table='aiMissions'` into live Mission records via field-level LWW (`src/db/missions-projection.ts`)
 - [x] Lists due missions (`state='active' && nextRunAt <= now()`)
@@ -59,7 +59,7 @@ Was offen ist (Phase 3, Frontend):
 - [ ] Feature-Flag `PUBLIC_AI_MISSION_GRANTS=false` default + Rollout (till → beta → alpha).
 - [ ] Produktions-Keypair generieren + in Mac-Mini Secrets ablegen.
 
-## Port: 3066
+## Port: 3067
 
 ## Tech Stack
 
@@ -78,14 +78,14 @@ cd services/mana-ai
 bun run dev
 
 # Smoke test
-curl http://localhost:3066/health
-curl -X POST -H "X-Service-Key: dev-service-key" http://localhost:3066/internal/tick
+curl http://localhost:3067/health
+curl -X POST -H "X-Service-Key: dev-service-key" http://localhost:3067/internal/tick
 ```
 
 ## Environment Variables
 
 ```env
-PORT=3066
+PORT=3067
 SYNC_DATABASE_URL=postgresql://mana:devpassword@localhost:5432/mana_sync
 MANA_LLM_URL=http://localhost:3020
 MANA_SERVICE_KEY=dev-service-key
@@ -98,7 +98,7 @@ TICK_ENABLED=true    # flip to false to boot HTTP-only (for Docker health-check)
 ```
 ┌────────────────────┐
 │  mana-ai (Bun)     │
-│    :3066           │
+│    :3067           │
 │                    │   60s interval
 │  ┌─────────────┐   │────────────────┐
 │  │ tick loop   │   │                │

services/mana-ai/Dockerfile

@@ -29,9 +29,9 @@ COPY services/mana-ai/tsconfig.json ./services/mana-ai/
 
 WORKDIR /app/services/mana-ai
 
-EXPOSE 3066
+EXPOSE 3067
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
-  CMD bun -e "fetch('http://localhost:3066/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+  CMD bun -e "fetch('http://localhost:3067/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
 
 CMD ["bun", "run", "src/index.ts"]

services/mana-ai/src/config.ts

@@ -43,7 +43,7 @@ function requireEnv(key: string, fallback?: string): string {
 
 export function loadConfig(): Config {
 	return {
-		port: parseInt(process.env.PORT ?? '3066', 10),
+		port: parseInt(process.env.PORT ?? '3067', 10),
 		syncDatabaseUrl: requireEnv(
 			'SYNC_DATABASE_URL',
 			'postgresql://mana:devpassword@localhost:5432/mana_sync'