catalogue: one mesh-state namespace — /var/lib/mesh/<module>/ (consistency)

The review found broker own-secret paths drifting: mostly /var/lib/<module>/
broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge
a collision with the service's own /var/lib/<name> data, and photos sat under
/etc. Normalized to one collision-free namespace a service never owns:
/var/lib/mesh/<module>/broker, with a mesh-state directory resource for the
parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced
by the assigned test, and it has no service to collide with). All 33 manifests
parse; no client hardcoded a path, so nothing in code moved.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/cloudflare-dns/module.json

@@ -18,13 +18,19 @@
   },
   "own-secrets": {
     "token": "/var/lib/cloudflare-dns/token",
-    "broker": "/var/lib/cloudflare-dns/broker"
+    "broker": "/var/lib/mesh/cloudflare-dns/broker"
   },
   "emits": [
     "module.cloudflare-dns.record.created",
     "module.cloudflare-dns.record.removed"
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/cloudflare-dns",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",
@@ -61,7 +67,7 @@
         "/var/lib/cloudflare-dns/config.json:/run/config/config.json:ro",
         "/var/lib/cloudflare-dns/grants:/grants",
         "/var/lib/cloudflare-dns/token:/run/secrets/token:ro",
-        "/var/lib/cloudflare-dns/broker:/run/secrets/broker:ro"
+        "/var/lib/mesh/cloudflare-dns/broker:/run/secrets/broker:ro"
       ]
     }
   ]