security: keep rootless podman storage on /mnt/data

Container images and build caches (anotherim-js's build images alone
are several GB each) had filled the root filesystem, and a NDK unzip
in an image build failed with the disk full. Point
rootless_storage_path at the data disk. Existing storage was moved
there with its libpod database paths rewritten.

Assisted-by: Claude:opus-5

modules/security.nix

@@ -75,6 +75,8 @@
       defaultNetwork.settings.dns_enabled = true;
     };
     oci-containers.backend = "podman";
+    # Rootless images and build caches on the data disk, not the root fs
+    containers.storage.settings.storage.rootless_storage_path = "/mnt/data/containers/$USER";
   };
 
   virtualisation.docker.enable = lib.mkForce false;