dankclaw: standardize gitea/authentik/hermes data roots under /home/dank/Containers

Repoint Volume=/EnvironmentFile= in the 8 affected quadlet units to the
caddy-established Containers/<svc> layout: gitea (data, postgres, env),
authentik (data, postgres), hermes (data, webui checkout). Data-root mv on the
target happens at deploy time before each group's unit restart; same-fs rename,
instantly reversible. Running containers keep their inode-bound binds until the
unit restart flips them to the new path.

dankclaw/gitea/quadlet/gitea-postgres.container

@@ -3,7 +3,7 @@
 # Install path on dankclaw: ~/.config/containers/systemd/gitea-postgres.container
 # Unit name: gitea-postgres.service (podman 5.x drops the container- prefix)
 #
-# The DB password lives in /opt/gitea/.env on the host (mode 0600).
+# The DB password lives in /home/dank/Containers/gitea/env on the host (mode 0600).
 # This file holds no secrets. See serverAppConfigs-docs/Dankclaw/Gitea.md.
 # The [Service] EnvironmentFile= line lets systemd expand
 # ${GITEA_DB_PASSWORD} in the generated ExecStart.
@@ -16,14 +16,14 @@ After=network.target
 ContainerName=gitea-postgres
 Network=gitea.network
 Image=docker.io/library/postgres:16-alpine
-EnvironmentFile=/opt/gitea/.env
+EnvironmentFile=/home/dank/Containers/gitea/env
 Environment=POSTGRES_USER=gitea
 Environment=POSTGRES_PASSWORD=${GITEA_DB_PASSWORD}
 Environment=POSTGRES_DB=gitea
-Volume=/opt/gitea/data/gitea-postgres:/var/lib/postgresql/data
+Volume=/home/dank/Containers/gitea/postgres:/var/lib/postgresql/data
 
 [Service]
-EnvironmentFile=/opt/gitea/.env
+EnvironmentFile=/home/dank/Containers/gitea/env
 TimeoutStartSec=900
 Restart=always