Five modules keep their own secrets from the vault, under local names; route-proxy declares its bases

gitea, umami, influxdb, icecast and mailu require a secret and keep each of theirs
under a local name (novox/hq ADR 0094); the broker account stays their own. The
route proxy's recipe starts FROM the bases its manifest declares (ADR 0097).

modules/umami/module.json

@@ -6,7 +6,8 @@
   ],
   "requires": [
     "postgres-database",
-    "route"
+    "route",
+    "secret"
   ],
   "contributes": {
     "postgres-database": {
@@ -22,7 +23,11 @@
     "route": "/var/lib/umami/route.json"
   },
   "secrets": {
-    "postgres-database": "/var/lib/umami/database.secret"
+    "postgres-database": "/var/lib/umami/database.secret",
+    "secret": {
+      "app-secret": "/var/lib/umami/app.secret",
+      "admin": "/var/lib/umami/admin.secret"
+    }
   },
   "provides": [
     {
@@ -40,8 +45,6 @@
     "analytics": "/var/lib/umami/grants"
   },
   "own-secrets": {
-    "app-secret": "/var/lib/umami/app.secret",
-    "admin": "/var/lib/umami/admin.secret",
     "broker": "/var/lib/mesh/umami/broker"
   },
   "listens": [