fix(infra): relocate mana-ai from 3066 to 3067 — port clash with news-ingester

news-ingester already owns 3066 (see docker-compose.macmini.yml:1620).
Moving mana-ai to 3067 — the next free slot in the 306x services block
(credits 3061, user 3062, subscriptions 3063, analytics 3064,
events 3065, news-ingester 3066, mana-ai 3067).

Updated: Dockerfile EXPOSE + HEALTHCHECK, config.ts default,
compose service/healthcheck/port mapping, webapp getManaAiUrl()
fallback, root CLAUDE.md service list, mana-ai/CLAUDE.md, and
COMPANION_BRAIN_ARCHITECTURE.md §20 file map.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/architecture/COMPANION_BRAIN_ARCHITECTURE.md

@@ -1794,7 +1794,7 @@ Code:
     stempelt `__lastActor` + `__fieldActors` aus eingehenden Changes
     → **cross-device Attribution geschlossen**
 - [x] Schritt 9 — Server-side `mana-ai` Bun-Service (v0.3, Close-the-Loop)
-  - `services/mana-ai/` — Hono/Bun auf Port 3066
+  - `services/mana-ai (3067
   - `@mana/shared-ai` Package als Single-Source-of-Truth für Planner-
     Prompt + Parser + Typen (Webapp + Service importieren identisch)
   - Field-level LWW-Replay von `sync_changes` in `db/missions-projection.ts`