basement: add data dir bind mount (/var/lib/basement-ui)

Last config blocker — basement-ui's store.Open() calls MkdirAll on
BASEMENT_DATA_DIR (default /var/lib/basement-ui), which fails inside
the container because / is read-only-ish for the unprivileged user.

Mount /mnt/user/appdata/basement to /var/lib/basement-ui via a Path
Config; install.sh pre-creates the directory (and host-agent's
appdata while we're at it, since we never explicitly created that
either — it had been working by luck).

Source-checked the basement-ui repo for any other "is required" env
vars; ADMIN_USER / ADMIN_PASSWORD_HASH / JWT_SECRET / DRIVER (+ the
two DRIVER_GARAGE_* when DRIVER=garage) are the complete set. After
this, container should reach Up.

unraid-1/basement.template.xml

@@ -49,6 +49,8 @@ Publicly served at https://basement.pq.io via Caddy on classe (reverse proxy →
 
   <Config Name="WebUI" Target="8080" Default="8080" Mode="tcp" Description="HTTP port. Caddy on classe proxies basement.pq.io here." Type="Port" Display="always" Required="true" Mask="false">8080</Config>
 
+  <Config Name="Data dir" Target="/var/lib/basement-ui" Default="/mnt/user/appdata/basement" Mode="rw" Description="Persistent state (audit log, sessions). basement-ui's default BASEMENT_DATA_DIR; container can't mkdir under / so this mount is required." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/basement</Config>
+
   <Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Target="BASEMENT_DRIVER_GARAGE_ADMIN_URL" Default="http://host.docker.internal:3903" Mode="" Description="Garage admin API base URL (reaches the sibling garage container via the host-gateway alias). basement-ui namespaces driver-specific config as BASEMENT_DRIVER_GARAGE_*." Type="Variable" Display="always" Required="true" Mask="false">http://host.docker.internal:3903</Config>
   <Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Target="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Default="" Mode="" Description="Bearer token for Garage admin API. Pre-filled by install.sh (same value as the garage container's GARAGE_ADMIN_TOKEN)." Type="Variable" Display="always" Required="true" Mask="true">__GARAGE_ADMIN_TOKEN__</Config>
 

unraid-1/install.sh

@@ -38,7 +38,7 @@ die() { printf "install.sh: %s\n" "$*" >&2; exit 1; }
 [ -d /mnt/user ]                       || die "/mnt/user missing — is the array started?"
 [ -d /mnt/user/s3 ]                    || die "share /mnt/user/s3 missing. Create it in unraid UI first (Shares → Add Share → 's3', cache:yes recommended), then re-run."
 
-mkdir -p "$APPDATA/meta" "$DATADIR" "$TEMPLATE_DIR"
+mkdir -p "$APPDATA/meta" "$DATADIR" "$TEMPLATE_DIR" /mnt/user/appdata/basement /mnt/user/appdata/host-agent
 
 # ── garage.toml ──
 if [ -f "$TOML_DEST" ] && [ "${FORCE:-}" != "1" ]; then