sonarr: its config dir is placed, its image is the one ace runs

The manifest named /services/sonarr/config and /var/lib/mesh/sonarr/route.json, host
paths ADR 0112 takes out of definitions. The config dir is now a pathless ${dir:config}
(0700, 1000:1000) mounted into the server and, read-only, into the runtime that reads the
API key from config.xml; the route binding lives in a placed state dir, as jackett and
searxng do. /var/lib/mesh/sonarr stays for the broker secret.

The image is pinned to 4.0.20.3014-ls325, the digest ace runs today. The old pin
(4.0.19.2979-ls322) was older than the running version, and Sonarr migrates its database
forward on start, so pointing the older build at ace's data is not safe.

The container mount points stay /series, /anime and /downloads: Sonarr's database stores
its root folders and the download clients' reported paths under exactly those names, and
there are no remote path mappings to absorb a change. The generic access paths stay;
ace's (/storage/media/*, /storage/downloads) and its media owner 1001:2000 wait on hq 153.

Based on feat/servarr-api-provision (#156), which makes sonarr provide sonarr-api.

Verified: catalogue key tests with MESH_CATALOGUE set (73 manifests parsed, not skipped);
a throwaway container of the pinned image on a fresh 0700 1000:1000 config dir answers
/ping, serves the v3 API with the key it generated and refuses a wrong one (401), accepts
/series as a writable root folder; the runtime's client discovers the key from that
config.xml and reads the queue.

modules/sonarr/module.json

@@ -31,7 +31,7 @@
       "port": 8989,
       "protocol": "tcp",
       "from": "mesh",
-      "why": "managing series"
+      "why": "managing series: its web UI, and the API other modules reach as sonarr-api"
     }
   ],
   "accesses": [
@@ -55,10 +55,15 @@
       "path": "/var/lib/mesh/sonarr",
       "mode": "0700"
     },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
     {
       "id": "config",
       "type": "directory",
-      "path": "/services/sonarr/config",
       "mode": "0700",
       "owner": "1000:1000"
     },
@@ -66,7 +71,7 @@
       "id": "server",
       "type": "container",
       "name": "sonarr",
-      "image": "lscr.io/linuxserver/sonarr@sha256:c19aa4ecdf03d73e1d5c901da33744cb7eb4d921f89bafed1ca264601d7fa224",
+      "image": "lscr.io/linuxserver/sonarr@sha256:a5c1a5fecbef946927ab90ad68df319ac5fe644057e5fc18cd993f01ac07b2b2",
       "env": {
         "PUID": "1000",
         "PGID": "1000",
@@ -76,7 +81,7 @@
         "8989"
       ],
       "volumes": [
-        "/services/sonarr/config:/config",
+        "${dir:config}:/config",
         "/services/media/series:/series",
         "/services/media/anime:/anime",
         "/services/media/downloads:/downloads"
@@ -89,7 +94,7 @@
       "network": "host",
       "volumes": [
         "/var/lib/mesh/sonarr/broker:/run/secrets/broker:ro",
-        "/services/sonarr/config:/var/lib/sonarr/config:ro"
+        "${dir:config}:/var/lib/sonarr/config:ro"
       ],
       "env": {
         "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -109,7 +114,7 @@
     }
   },
   "binds": {
-    "route": "/var/lib/mesh/sonarr/route.json"
+    "route": "${dir:state}/route.json"
   },
   "build": {
     "on": [