catalogue: one mesh-state namespace — /var/lib/mesh/<module>/ (consistency)

The review found broker own-secret paths drifting: mostly /var/lib/<module>/
broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge
a collision with the service's own /var/lib/<name> data, and photos sat under
/etc. Normalized to one collision-free namespace a service never owns:
/var/lib/mesh/<module>/broker, with a mesh-state directory resource for the
parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced
by the assigned test, and it has no service to collide with). All 33 manifests
parse; no client hardcoded a path, so nothing in code moved.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/registry/module.json

@@ -20,7 +20,7 @@
     "module.registry.image.pushed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/registry/broker"
+    "broker": "/var/lib/mesh/registry/broker"
   },
   "serves": {
     "artifact-store": {