R-203: the app and its backup look in the same directory — one resolver, every caller

appbackup's path helpers take a NAMESPACE ROOT. Five call sites passed a bare DRIVE path.
On an enrolled drive the two coincide, so nothing showed; on the system-data fallback they
differ by exactly the felhom-data segment, and the app then bound a directory the off-site
capture set never looked at -- while the run reported ok. Measured live on demo-hp: the app
wrote to /mnt/sys_drive/userdata/media/books, the capture set looked for
/mnt/sys_drive/felhom-data/userdata/media/books.

THE RULE NOW HAS ONE EXPRESSION. appbackup.NamespaceRootFor / IsEnrolledDrive encode the
drive-kind comparison; backup.Manager.namespaceRoot and stacks.Manager.inGuest delegate to
it. There were already TWO copies and they differed -- the backup package's compared without
filepath.Clean, the stacks package's with it, so a trailing slash from config would have
flipped the mode in one and not the other.

Sites routed through it:
  - stacks/deploy.go withPathVars -> ${USERDATA_PATH}   (the live defect)
  - appexport/fabplan.go + export.go                     (via a new provider method)
  - web/handlers.go FileBrowser mounts                   (latent: the system drive is
    deliberately never a registered StoragePath, so this is the identity today)

ComputeFabBuckets now receives the namespace root, which is what ComputeCaptureSet has always
received -- so the export's classified paths and the backup's capture set describe the same
directories by construction instead of by coincidence.

Tests are table-driven over BOTH drive kinds, because this survived by being invisible on the
kind that already worked. Red-proofs observed: restoring the bare-path call fails the
system-drive row with the two paths differing by /felhom-data; inverting the drive-kind
comparison fails every enrolled row.

controller/internal/stacks/userdata_belt_test.go

@@ -78,8 +78,9 @@ func TestEnsureUserdataMounts_CreatesBeltDirs(t *testing.T) {
 // adds nothing when it's empty. Regression for the initial-deploy bug where ${USERDATA_PATH} resolved
 // to "" and bound a bogus root-owned dir at the container root.
 func TestWithPathVars(t *testing.T) {
+	const sysDataPath = "/mnt/sys_drive"
 	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
-	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-usb", importRoot)
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-usb", sysDataPath, importRoot)
 	want := "USERDATA_PATH=" + appbackup.UserdataDir("/mnt/felhom-usb")
 	found := false
 	for _, e := range got {
@@ -91,7 +92,7 @@ func TestWithPathVars(t *testing.T) {
 		t.Errorf("USERDATA_PATH not injected: got %v, want %q", got, want)
 	}
 	// companion: empty HDD_PATH → no USERDATA_PATH at all
-	for _, e := range withPathVars([]string{"DOMAIN=x"}, "", importRoot) {
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "", sysDataPath, importRoot) {
 		if strings.HasPrefix(e, "USERDATA_PATH") {
 			t.Errorf("USERDATA_PATH must NOT be set when HDD_PATH is empty: %q", e)
 		}
@@ -103,15 +104,16 @@ func TestWithPathVars(t *testing.T) {
 // root-owned dir at the container root. And the unresolvable case must leave the variable UNSET —
 // never fall back to a per-drive path, which would recreate the dead-drop-zone shape R-75 removes.
 func TestWithPathVars_ImportPath(t *testing.T) {
+	const sysDataPath = "/mnt/sys_drive"
 	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
 
-	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", importRoot)
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", sysDataPath, importRoot)
 	if !slices.Contains(got, "IMPORT_PATH="+importRoot) {
 		t.Errorf("IMPORT_PATH not injected: got %v", got)
 	}
 	// It is CANONICAL: it must not be derived from HDD_PATH. A second app on a different drive gets
 	// the identical value — that is the whole point of the canonical root.
-	other := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/nvme-1tb", importRoot)
+	other := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/nvme-1tb", sysDataPath, importRoot)
 	if !slices.Contains(other, "IMPORT_PATH="+importRoot) {
 		t.Errorf("IMPORT_PATH must not vary with HDD_PATH: got %v", other)
 	}
@@ -121,7 +123,7 @@ func TestWithPathVars_ImportPath(t *testing.T) {
 		}
 	}
 	// Unresolvable → UNSET (compose then fails loudly on ${IMPORT_PATH}).
-	for _, e := range withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", "") {
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", sysDataPath, "") {
 		if strings.HasPrefix(e, "IMPORT_PATH") {
 			t.Errorf("IMPORT_PATH must NOT be set when the import root is unresolvable: %q", e)
 		}