catalogue: one mesh-state namespace — /var/lib/mesh/<module>/ (consistency)

The review found broker own-secret paths drifting: mostly /var/lib/<module>/
broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge
a collision with the service's own /var/lib/<name> data, and photos sat under
/etc. Normalized to one collision-free namespace a service never owns:
/var/lib/mesh/<module>/broker, with a mesh-state directory resource for the
parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced
by the assigned test, and it has no service to collide with). All 33 manifests
parse; no client hardcoded a path, so nothing in code moved.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/icecast/module.json

@@ -12,7 +12,7 @@
     "source": "/var/lib/icecast-module/source.secret",
     "admin": "/var/lib/icecast-module/admin.secret",
     "relay": "/var/lib/icecast-module/relay.secret",
-    "broker": "/var/lib/icecast-module/broker"
+    "broker": "/var/lib/mesh/icecast/broker"
   },
   "listens": [
     {
@@ -23,6 +23,12 @@
     }
   ],
   "resources": [
+    {
+      "id": "mesh-state",
+      "type": "directory",
+      "path": "/var/lib/mesh/icecast",
+      "mode": "0700"
+    },
     {
       "id": "state",
       "type": "directory",