modules: wire tool-runtime app credentials as own-secrets

The six modules that run a mesh-<mod> tool-runtime sidecar read an app
credential from an env var the manifest never provided, so the sidecar
crash-looped in the whole-mesh dry-run (e.g. "no Plex token — set
MESH_PLEX_TOKEN"). These are operator-set app secrets, so deliver them the
same way cloudflare-dns delivers its API token: an own-secret file mounted
read-only, with a MESH_<APP>_*_FILE env pointing at the mount, and the
runtime code preferring that file (falling back to the existing env so
nothing regresses).

- plex: own-secret token -> /run/secrets/token, MESH_PLEX_TOKEN_FILE
- bazarr: own-secret api-key -> /run/secrets/api-key, MESH_BAZARR_API_KEY_FILE
- ombi: own-secret api-key -> /run/secrets/api-key, MESH_OMBI_API_KEY_FILE
- home-assistant: own-secret token -> /run/secrets/token, MESH_HOMEASSISTANT_TOKEN_FILE
- nzbget: own-secret password -> /run/secrets/password, MESH_NZBGET_PASSWORD_FILE (URL stays plain env)
- qbittorrent: own-secret password -> /run/secrets/password, MESH_QBITTORRENT_PASSWORD_FILE (URL stays plain env)

The operator now completes each with `secret accept <node> <module> <name> --from <file>`.
tsc passes for all six.

modules/home-assistant/module.json

@@ -8,7 +8,8 @@
     "module.home-assistant.state.changed"
   ],
   "own-secrets": {
-    "broker": "/var/lib/mesh/home-assistant/broker"
+    "broker": "/var/lib/mesh/home-assistant/broker",
+    "token": "/var/lib/mesh/home-assistant/token"
   },
   "listens": [
     {
@@ -61,12 +62,14 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/home-assistant/broker:/run/secrets/broker:ro",
+        "/var/lib/mesh/home-assistant/token:/run/secrets/token:ro",
         "/var/lib/mesh/home-assistant/config.json:/run/config/config.json:ro",
         "/services/home-assistant/config:/var/lib/home-assistant/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
         "MESH_HOMEASSISTANT_URL": "http://127.0.0.1:8123",
+        "MESH_HOMEASSISTANT_TOKEN_FILE": "/run/secrets/token",
         "MESH_HOMEASSISTANT_CONFIG_FILE": "/run/config/config.json",
         "MESH_HOMEASSISTANT_CONFIG_DIR": "/var/lib/home-assistant/config"
       },