Declare every module's data; the backup holder measures it (hq ADR 0233)

Backup lines are derived from each module's data section instead of written by hand; the holder
measures declared items, reads the array under them, and deletes a retired item only after a last
restore point; the Go providers say each held consumer's size so an empty replacement is seen.

modules/mesh-vault/module.json

@@ -30,6 +30,35 @@
     "secret": "${dir:grants}"
   },
   "keeps": "/var/lib/mesh-vault/root",
+  "data": {
+    "own": [
+      {
+        "id": "state",
+        "path": "${dir:state}",
+        "class": "valuable",
+        "why": "the vault's own keys"
+      },
+      {
+        "id": "ledger",
+        "path": "${dir:ledger}",
+        "class": "valuable",
+        "why": "every secret the vault keeps"
+      },
+      {
+        "id": "root",
+        "path": "${dir:root}",
+        "class": "valuable",
+        "why": "the vault's root material"
+      }
+    ],
+    "consumers": {
+      "secret": {
+        "class": "valuable",
+        "in": "ledger",
+        "why": "a secret given to a consumer is kept nowhere else in the clear"
+      }
+    }
+  },
   "resources": [
     {
       "id": "state",
@@ -82,12 +111,5 @@
       "name": "mesh-vault",
       "scope": "mesh"
     }
-  ],
-  "contributions": [
-    {
-      "seat": "node-backup",
-      "kind": "backup",
-      "content": "path ${dir:state}\npath ${dir:ledger}\npath ${dir:root}\n"
-    }
   ]
 }