feat(gpu-box): mana-ai (AI Mission Runner) migrated, mana-ai.mana.how → GPU tunnel

Phase 2f-3 (final of the 2f-trio). The background tick-loop runner is
the most coupled of the three: it queries mana-api, mana-llm, and
mana-research, and writes through to the mana_sync DB. Wired up via
cross-LAN host-IPs to those Mini-side services + the existing RSA
key-pair for Mission-Grant decryption (MANA_AI_PRIVATE_KEY_PEM moved
into /srv/mana/.env on the GPU-Box; the matching MANA_AI_PUBLIC_KEY_PEM
stays on mana-auth's env-set as before).

Bonus rationale: AI Mission Runner now sits in the same compose
network as the GPU-Box's gpu-llm/gpu-ollama tasks, so future
"agent talks to local LLM" paths skip the Cloudflare round-trip.

Tunnel: mana-ai.mana.how repointed at the mana-gpu-server tunnel
(config v28). The Mini-side ingress was removed in the same step.
OTEL_EXPORTER_OTLP_ENDPOINT cleared since Tempo was retired in 2c.

Mini-side: container stopped + removed from docker-compose.macmini.yml.
Running count went from 39 → 42 because of unrelated services that
re-appeared on the latest CD pull (cards-server, memoro-web), but the
actual mana-ai service is gone — net move accomplished.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

infrastructure/docker-compose.gpu-box.yml

@@ -523,6 +523,47 @@ services:
       retries: 3
       start_period: 30s
 
+  # ============================================
+  # Phase 2f-3 — mana-ai (AI Mission Runner, 2026-05-07)
+  # Background tick-loop (60s default), queryt mana-api + mana-llm +
+  # mana-research, persistiert via mana_sync. Geographische Nähe zum
+  # gpu-llm/gpu-ollama-Stack ist Bonus für künftige direct-LLM-Pfade.
+  # services/mana-ai/Dockerfile ist bereits workspace-aware (pnpm
+  # multi-stage), funktioniert nativ auf GPU-Box.
+  # ============================================
+  mana-ai:
+    build:
+      context: /srv/mana/source
+      dockerfile: services/mana-ai/Dockerfile
+    image: mana-ai:gpu-box
+    container_name: mana-ai
+    restart: unless-stopped
+    environment:
+      TZ: Europe/Berlin
+      PORT: 3067
+      NODE_ENV: production
+      TICK_INTERVAL_MS: '60000'
+      TICK_ENABLED: 'true'
+      MANA_AI_DEEP_RESEARCH_ENABLED: 'false'
+      # Cross-LAN dependency wiring — alle Mini-Services via Host-Port.
+      MANA_API_URL: http://192.168.178.131:3060
+      SYNC_DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@192.168.178.131:5432/mana_sync
+      MANA_LLM_URL: http://192.168.178.131:3025
+      MANA_RESEARCH_URL: http://192.168.178.131:3068
+      # Internal-service-auth + RSA für Mission-Grant-Decryption.
+      MANA_SERVICE_KEY: ${MANA_SERVICE_KEY}
+      MANA_AI_PRIVATE_KEY_PEM: ${MANA_AI_PRIVATE_KEY_PEM}
+      # OTEL: Tempo läuft seit Phase 2c nicht mehr — leer = SDK no-op
+      OTEL_EXPORTER_OTLP_ENDPOINT: ''
+    ports:
+      - '3067:3067'
+    healthcheck:
+      test: ['CMD', 'bun', '-e', "fetch('http://localhost:3067/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
   verdaccio:
     image: verdaccio/verdaccio:6
     container_name: mana-verdaccio