R-839: the deploy API refuses an HDD_PATH that is a folder inside a registered drive

Diagnosed: 9202's paperless-ngx app.yaml named <drive>/userdata/paperless-ngx, written by the
2026-09-22 drill harness through POST /api/stacks/<n>/deploy, which accepted it (RefuseAsAppNamespace
matches by prefix). The boot sweep then asked a folder whether it was a mountpoint and HELD the app.
The deploy page offers drive roots only, so a household could not reach this; every other caller
is now refused with a sentence naming the drive (settings.DriveOfSubPath).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/scripts/i18n_go_keys.json

@@ -136,6 +136,7 @@
     "err.backup.unit_version_mismatch": "BORN AS A KEY, v0.275.0 (R-696, `07` §6.6 which version a restore brings back) -- a NEW sentence, never a Go literal. Pinned by internal/backup/a_version_travel_test.go / internal/web/a_version_travel_test.go.",
     "deploy.login_from_backup": "BORN AS A KEY, v0.275.0 (R-694) -- a NEW sentence, never a Go literal. Pinned by internal/web/r694_restored_login_test.go.",
     "flash.offbox.enabled_all": "v0.283.0 decision 50: born as a key (the one-press off-site offer)",
+    "api.deploy.hdd_path_inside_drive": "R-839: born as a key (deploy refuses an HDD_PATH inside a registered drive); pinned by TestR839_DeployRefusesASubPathOfADrive",
     "flash.offbox.clear_needs_confirmation": "R-729/R-545: born as a key (the household's off-site target clear press); pinned by TestR729_ClearHandler_*",
     "flash.offbox.clear_hub_tier": "R-729/R-545: born as a key (the household's off-site target clear press); pinned by TestR729_ClearHandler_*",
     "flash.offbox.clear_busy": "R-729/R-545: born as a key (the household's off-site target clear press); pinned by TestR729_ClearHandler_*",