The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

48 definitions stop naming /var/lib/mesh/<module>: the directory says `place: "mesh"`, the two
subdirectories beneath it (gitea's runtime state, anthropic-manager's output) state their path
beneath it, and every credential, binding, merged file and mount names it as ${dir:mesh-state}.
Resolved on the default root, every definition names exactly the paths it named before —
TestPlacedDirectoriesKeepTheirPaths in mesh-controller, run over both checkouts. Needs the
controller that knows the word (mesh-controller, same branch) one release ahead.

modules/nodered/module.json

@@ -5,9 +5,9 @@
     "flows.deployed"
   ],
   "own-secrets": {
-    "admin": "/var/lib/mesh/nodered/admin",
-    "api-token": "/var/lib/mesh/nodered/api-token",
-    "broker": "/var/lib/mesh/nodered/broker"
+    "admin": "${dir:mesh-state}/admin",
+    "api-token": "${dir:mesh-state}/api-token",
+    "broker": "${dir:mesh-state}/broker"
   },
   "capabilities": [
     "container-runtime"
@@ -25,8 +25,8 @@
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/nodered",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "state",
@@ -90,7 +90,7 @@
     {
       "id": "runtime-config",
       "type": "file",
-      "path": "/var/lib/mesh/nodered/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
     },
@@ -100,8 +100,8 @@
       "name": "mesh-nodered",
       "network": "host",
       "volumes": [
-        "/var/lib/mesh/nodered/broker:/run/secrets/broker:ro",
-        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro"
+        "${dir:mesh-state}/broker:/run/secrets/broker:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -120,7 +120,7 @@
       "network": "host",
       "run-once": true,
       "volumes": [
-        "/var/lib/mesh/nodered/config.json:/run/config/config.json:ro",
+        "${dir:mesh-state}/config.json:/run/config/config.json:ro",
         "${dir:written}:/var/lib/nodered-provisions",
         "${dir:state}/mqtt-topic.json:/run/provisions/mqtt-topic.json:ro",
         "${dir:state}/mqtt-topic.secret:/run/provisions/mqtt-topic.secret:ro",