catalogue: one mesh-state namespace — /var/lib/mesh/<module>/ (consistency)

The review found broker own-secret paths drifting: mostly /var/lib/<module>/
broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge
a collision with the service's own /var/lib/<name> data, and photos sat under
/etc. Normalized to one collision-free namespace a service never owns:
/var/lib/mesh/<module>/broker, with a mesh-state directory resource for the
parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced
by the assigned test, and it has no service to collide with). All 33 manifests
parse; no client hardcoded a path, so nothing in code moved.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/gitea/module.json

@@ -39,9 +39,15 @@
   ],
   "own-secrets": {
     "internal-token": "/var/lib/gitea/internal-token.secret",
-    "broker": "/var/lib/gitea/broker"
+    "broker": "/var/lib/mesh/gitea/broker"
   },
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/gitea",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",