Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

gitea, umami, influxdb, icecast and mailu require a secret and keep each of theirs
under a local name (novox/hq ADR 0094); the broker account stays their own. The
route proxy's recipe starts FROM the bases its manifest declares (ADR 0097).

modules/gitea/module.json

@@ -3,7 +3,8 @@
   "version": "1",
   "requires": [
     "postgres-database",
-    "route"
+    "route",
+    "secret"
   ],
   "contributes": {
     "postgres-database": {
@@ -19,7 +20,11 @@
     "route": "/var/lib/gitea/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/gitea/database.secret"
+    "postgres-database": "/var/lib/gitea/database.secret",
+    "secret": {
+      "internal-token": "/var/lib/gitea/internal-token.secret",
+      "admin": "/var/lib/gitea/admin.secret"
+    }
   },
   "capabilities": [
     "container-runtime"
@@ -57,8 +62,6 @@
     "package-registry": "/var/lib/gitea/grants"
   },
   "own-secrets": {
-    "internal-token": "/var/lib/gitea/internal-token.secret",
-    "admin": "/var/lib/gitea/admin.secret",
     "broker": "/var/lib/mesh/gitea/broker"
   },
   "resources": [