To store db files in any location, you do have to configure FB to allow that IIRC, I *think* it limits db access to a single directory by default for security reasons.
(It's a bit hazy though because I generally put my db files in the single directory anyway)
No, there is no such limit. You can put your db-s anywhere on different places on the server hard discs where Firebird process has read and write access.
The best practice is to use aliases instead of real paths of database. You should edit the file "aliases.conf", which you will find in your Firebird installation folder (in Linux, you will find it under /etc/firebird/2.5/). Add aliases for each database you have on this server. Then, the client can and should access the database through its alias — server_host/port:<db_alias>.
Further, for maximum security, edit the file "firebird.conf", find the key "DatabaseAccess" and set it to "None", which means that only connecting through aliases, and not with actual path are allowed on this server.
After editing aliases.conf or firebird.conf, it might be required to restart fb service for new settings.
Then, in Lazarus, in IBConnection (ZConnection, if you use Zeos), you should set DatabaseName (Database) field to alias, not to db path.