gitea: its data and grants are placed, not stated

The mesh resolves both to <root>/gitea/<id> — where the 5.8G forge and
its grant files already sit, so the roll-out its upgrade policy makes
of this build changes no byte of the spec. The module root and the
mesh's plumbing stay stated.

modules/gitea/module.json

@@ -24,11 +24,11 @@
     }
   },
   "binds": {
-    "postgres-database": "/var/lib/gitea/database.json",
+    "postgres-database": "${dir:data}base.json",
     "route": "/var/lib/gitea/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/gitea/database.secret",
+    "postgres-database": "${dir:data}base.secret",
     "secret": {
       "internal-token": "/var/lib/gitea/internal-token.secret",
       "admin": "/var/lib/gitea/admin.secret"
@@ -53,7 +53,7 @@
       "port": 22,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "git over ssh, gitea's own unmodified sshd. Published on the machine's own side at 222, the mesh's fixed public convention — not 22, which the machine's own daemon holds and a module does not take"
+      "why": "git over ssh, gitea's own unmodified sshd. Published on the machine's own side at 222, the mesh's fixed public convention \u2014 not 22, which the machine's own daemon holds and a module does not take"
     }
   ],
   "serves": {
@@ -68,10 +68,10 @@
     }
   },
   "receives": {
-    "npm-package-registry": "/var/lib/gitea/grants/npm.json"
+    "npm-package-registry": "${dir:grants}/npm.json"
   },
   "grants": {
-    "npm-package-registry": "/var/lib/gitea/grants"
+    "npm-package-registry": "${dir:grants}"
   },
   "claims": [
     {
@@ -108,7 +108,6 @@
     {
       "id": "grants",
       "type": "directory",
-      "path": "/var/lib/gitea/grants",
       "mode": "0700"
     },
     {
@@ -121,7 +120,6 @@
     {
       "id": "data",
       "type": "directory",
-      "path": "/var/lib/gitea/data",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -143,7 +141,7 @@
         "222:22"
       ],
       "volumes": [
-        "/var/lib/gitea/data:/data"
+        "${dir:data}:/data"
       ],
       "secrets-in-environment": "gitea honours GITEA__database__PASSWD__FILE and GITEA__security__INTERNAL_TOKEN__FILE; convertible, awaiting a bed that proves it"
     },
@@ -162,7 +160,7 @@
         "/var/lib/gitea/server.env"
       ],
       "volumes": [
-        "/var/lib/gitea/data:/data",
+        "${dir:data}:/data",
         "/var/lib/gitea/admin.secret:/run/secrets/admin:ro"
       ],
       "args": [
@@ -188,7 +186,7 @@
       "volumes": [
         "/var/lib/mesh/gitea/broker:/run/secrets/broker:ro",
         "/var/lib/mesh/gitea/config.json:/run/config/config.json:ro",
-        "/var/lib/gitea/grants:/var/lib/gitea/grants:ro",
+        "${dir:grants}:${dir:grants}:ro",
         "/var/lib/gitea/admin.secret:/run/secrets/admin:ro",
         "/var/lib/mesh/gitea/state:/run/state"
       ],
@@ -199,7 +197,7 @@
         "MESH_GITEA_ADMIN_USER": "mesh-admin",
         "MESH_GITEA_ADMIN_PASSWORD_FILE": "/run/secrets/admin",
         "MESH_GITEA_STATE_DIR": "/run/state",
-        "MESH_RECEIVES": "/var/lib/gitea/grants/npm.json"
+        "MESH_RECEIVES": "${dir:grants}/npm.json"
       },
       "artifact": "runtime",
       "restart-on": [