dankclaw: standardize gitea/authentik/hermes data roots under /home/dank/Containers

Repoint Volume=/EnvironmentFile= in the 8 affected quadlet units to the
caddy-established Containers/<svc> layout: gitea (data, postgres, env),
authentik (data, postgres), hermes (data, webui checkout). Data-root mv on the
target happens at deploy time before each group's unit restart; same-fs rename,
instantly reversible. Running containers keep their inode-bound binds until the
unit restart flips them to the new path.

dankclaw/authentik/quadlet/authentik-outpost.container

@@ -32,7 +32,7 @@ Environment=AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
 Environment=AUTHENTIK_HOST=https://auth.franksdank.cloud
 Environment=AUTHENTIK_INSECURE=false
 Environment=AUTHENTIK_TOKEN=${AUTHENTIK_OUTPOST_TOKEN}
-Volume=/home/dank/authentik/data:/data
+Volume=/home/dank/Containers/authentik/data:/data
 User=0:0
 
 [Service]

dankclaw/authentik/quadlet/authentik-postgres.container

@@ -20,7 +20,7 @@ EnvironmentFile=/home/dank/serverAppConfigs/dankclaw/.env
 Environment=POSTGRES_DB=authentik
 Environment=POSTGRES_USER=authentik
 Environment=POSTGRES_PASSWORD=${AUTHENTIK_PG_PASS}
-Volume=/home/dank/authentik/postgres:/var/lib/postgresql/data
+Volume=/home/dank/Containers/authentik/postgres:/var/lib/postgresql/data
 # Unquoted argv: this quadlet generator space-splits HealthCmd into the
 # healthcheck's argv array, so a quoted probe would arrive mangled (the old
 # `/bin/sh -c "pg_isready..."` form arrived as /bin/sh + broken args and

dankclaw/authentik/quadlet/authentik-worker.container

@@ -25,7 +25,7 @@ Environment=AUTHENTIK_POSTGRESQL__NAME=authentik
 Environment=AUTHENTIK_POSTGRESQL__USER=authentik
 Environment=AUTHENTIK_POSTGRESQL__PASSWORD=${AUTHENTIK_PG_PASS}
 Environment=AUTHENTIK_SECRET_KEY=${AUTHENTIK_SECRET_KEY}
-Volume=/home/dank/authentik/data:/data
+Volume=/home/dank/Containers/authentik/data:/data
 User=0:0
 
 [Service]