More fiddling with permissions

 - server/ has to be writeable for sqlite file that lives in it
 - server/haxelib.db has to be writeable
 - server/tmp and server/files both have to be writeable
 - same for server/legacy

The entire folder being writeable sounds like a security issue to me...
but I guess not everyone runs on shared servers :)
Point them both to local servers for now
Realised TMP_DIR and REP_DIR both have to be in the web root

Because the existing haxelib tool uses straight HTTP for uploading and
downloading the zip files, our .htaccess redirect won't work.

The solution is to keep both in the top level directory, so:

 * I've adjusted legacy Site to point to ../files/
 * I've adjusted new Site to point to files/2.0/
 * I've adjusted site.sh to make sure 2.0 exists and is writeable

I figured we might as well keep the TMP_DIR shared if REP_DIR is,
so I've adjusted that also.