lidarr: its dirs are placed, its custom scripts are carried, its image is the one ace runs

ace's lidarr is not a plain lidarr. HAL mounts custom-cont-init.d and
custom-services.d, and the operator's arr-scripts run from them: an init
script installs beets/deemix/SMA on every start, and eight services
(Audio, AutoConfig, QueueCleaner, ARLChecker, ...) run beside lidarr and
are working today. The catalogue mounted neither, so a take would have
silently stopped all of it. Both are now pathless directories mounted at
the linuxserver image's own paths, root-owned 0755 as the image expects;
empty on a new machine, which the image skips.

The config dir is a pathless ${dir:config} instead of /services/lidarr/config,
the route binding lives in a placed state dir, and /var/lib/mesh/lidarr
keeps only the broker secret.

The image is pinned to the digest ace runs (3.1.0.4875-ls41, sha256:8ab0fd...).
The previous pin was ls40 - older than the data it would open.

Based on feat/servarr-api-provision (#156), which makes lidarr provide
lidarr-api; this branch contains it.

Verified: mesh-controller catalogue tests with MESH_CATALOGUE pointed here
pass (parse + mounts, not skipped); a resolve of route-adapter+lidarr on a
fake ace renders every ${dir:} and ${port:}; the pinned image in a
throwaway container ran a root-owned custom-cont-init.d script and started
a custom-services.d service, answered /ping, the UI and /api/v1/system/status
(200 with its key, 401 without), and re-owned a 1001:2000 file in /config to
PUID. With PUID 1000 it cannot write a 1001:2000 0775 library - the reason
ace needs hq 153 before a take.

modules/lidarr/module.json

@@ -51,18 +51,33 @@
       "path": "/var/lib/mesh/lidarr",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/lidarr/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
+    {
+      "id": "custom-cont-init",
+      "type": "directory",
+      "mode": "0755"
+    },
+    {
+      "id": "custom-services",
+      "type": "directory",
+      "mode": "0755"
+    },
     {
       "id": "server",
       "type": "container",
       "name": "lidarr",
-      "image": "lscr.io/linuxserver/lidarr@sha256:6b38dd330b0c653351c2e23c8b962ea51c95683dd7acace9d106c922baf85f75",
+      "image": "lscr.io/linuxserver/lidarr@sha256:8ab0fd370b604ae034d9a9c261a9d8d873bece33d9736852e7ce4f3566e4a35d",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -72,7 +87,9 @@
         "8686"
       ],
       "volumes": [
-        "/services/lidarr/config:/config",
+        "${dir:config}:/config",
+        "${dir:custom-cont-init}:/custom-cont-init.d",
+        "${dir:custom-services}:/custom-services.d",
         "/services/media/music:/music",
         "/services/media/downloads:/downloads"
       ]
@@ -84,7 +101,7 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/lidarr/broker:/run/secrets/broker:ro",
-        "/services/lidarr/config:/var/lib/lidarr/config:ro"
+        "${dir:config}:/var/lib/lidarr/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -104,7 +121,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/lidarr/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [