Six modules name no /var/lib: the root is a place, the maps reference it

The state directories say place "." — the assignment's own root — and
every bind, secret, own-secret, receives and grants path references it
as ${dir:state}/…; grants directories that are their own resources are
placed by id. gitea's two coincidence strings from the first pass
(${dir:data}base.json — resolving correctly by pure concatenation) are
spelled honestly now. What still says /var/lib is inside containers —
the software's contract — or under /var/lib/mesh, the mesh's own
plumbing, which the requirements unification absorbs next. Every
resolved path is byte-identical to what runs; landing this is a no-op
on the node, and the converter checks its own boundaries this time.

modules/only-office/module.json

@@ -15,10 +15,10 @@
     }
   },
   "binds": {
-    "route": "/var/lib/only-office/route.json"
+    "route": "${dir:state}/route.json"
   },
   "own-secrets": {
-    "jwt": "/var/lib/only-office/jwt.secret"
+    "jwt": "${dir:state}/jwt.secret"
   },
   "listens": [
     {
@@ -32,13 +32,13 @@
     {
       "id": "state",
       "type": "directory",
-      "path": "/var/lib/only-office",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
     },
     {
       "id": "server-env",
       "type": "file",
-      "path": "/var/lib/only-office/server.env",
+      "path": "${dir:state}/server.env",
       "mode": "0600",
       "content": "JWT_ENABLED=true\nJWT_SECRET=${secret:jwt}\nJWT_HEADER=Authorization\nJWT_IN_BODY=true\nALLOW_PRIVATE_IP_ADDRESS=true\n"
     },
@@ -89,7 +89,7 @@
       "image": "onlyoffice/documentserver@sha256:3ab6ebc7c605e5a32b7ae3ff19daed4925090245acc8100ce2230bd766c88212",
       "network": "only-office",
       "env-file": [
-        "/var/lib/only-office/server.env"
+        "${dir:state}/server.env"
       ],
       "ports": [
         "9070:80"