Six modules name no /var/lib: the root is a place, the maps reference it

The state directories say place "." — the assignment's own root — and
every bind, secret, own-secret, receives and grants path references it
as ${dir:state}/…; grants directories that are their own resources are
placed by id. gitea's two coincidence strings from the first pass
(${dir:data}base.json — resolving correctly by pure concatenation) are
spelled honestly now. What still says /var/lib is inside containers —
the software's contract — or under /var/lib/mesh, the mesh's own
plumbing, which the requirements unification absorbs next. Every
resolved path is byte-identical to what runs; landing this is a no-op
on the node, and the converter checks its own boundaries this time.

modules/nextcloud/module.json

@@ -17,20 +17,20 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/nextcloud/database.json",
-    "s3-bucket": "/var/lib/nextcloud/store.json",
-    "route": "/var/lib/nextcloud/route.json"
+    "postgres-database": "${dir:state}/database.json",
+    "s3-bucket": "${dir:state}/store.json",
+    "route": "${dir:state}/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/nextcloud/database.secret",
-    "s3-bucket": "/var/lib/nextcloud/store.secret"
+    "postgres-database": "${dir:state}/database.secret",
+    "s3-bucket": "${dir:state}/store.secret"
   },
   "emits": [
     "module.nextcloud.user.created",
     "module.nextcloud.share.created"
   ],
   "own-secrets": {
-    "admin": "/var/lib/nextcloud/admin.secret",
+    "admin": "${dir:state}/admin.secret",
     "broker": "/var/lib/mesh/nextcloud/broker"
   },
   "capabilities": [
@@ -54,13 +54,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/nextcloud",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "/var/lib/nextcloud/server.env",
+      "path": "${dir:state}/server.env",
       "mode": "0600",
       "content": "POSTGRES_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nPOSTGRES_DB=${bound:postgres-database:as}\nPOSTGRES_USER=${bound:postgres-database:as}\nPOSTGRES_PASSWORD=${secret:postgres-database}\nNEXTCLOUD_ADMIN_USER=mesh-admin\nNEXTCLOUD_ADMIN_PASSWORD=${secret:admin}\nOBJECTSTORE_S3_HOST=${bound:s3-bucket:at}\nOBJECTSTORE_S3_PORT=${bound:s3-bucket:port}\nOBJECTSTORE_S3_BUCKET=mesh-novox-ncloud\nOBJECTSTORE_S3_KEY=${bound:s3-bucket:as}\nOBJECTSTORE_S3_SECRET=${secret:s3-bucket}\nOBJECTSTORE_S3_SSL=false\nOBJECTSTORE_S3_USEPATH_STYLE=true\nOBJECTSTORE_S3_REGION=${bound:s3-bucket:region}\n"
     },
@@ -76,7 +76,7 @@
       "name": "nextcloud",
       "image": "nextcloud@sha256:fb966733647ea03f0446b0c22eac9733c8eb616d37b960caca9d4c3010e14a08",
       "env-file": [
-        "/var/lib/nextcloud/server.env"
+        "${dir:state}/server.env"
       ],
       "ports": [
         "80"
@@ -102,7 +102,7 @@
       "volumes": [
         "/var/lib/mesh/nextcloud/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/nextcloud/config.json:/run/config/config.json:ro",
-        "/var/lib/nextcloud/admin.secret:/run/secrets/admin:ro",
+        "${dir:state}/admin.secret:/run/secrets/admin:ro",
         "/var/run/docker.sock:/var/run/docker.sock"
       ],
       "env": {