R-203: the app and its backup look in the same directory — one resolver, every caller

appbackup's path helpers take a NAMESPACE ROOT. Five call sites passed a bare DRIVE path.
On an enrolled drive the two coincide, so nothing showed; on the system-data fallback they
differ by exactly the felhom-data segment, and the app then bound a directory the off-site
capture set never looked at -- while the run reported ok. Measured live on demo-hp: the app
wrote to /mnt/sys_drive/userdata/media/books, the capture set looked for
/mnt/sys_drive/felhom-data/userdata/media/books.

THE RULE NOW HAS ONE EXPRESSION. appbackup.NamespaceRootFor / IsEnrolledDrive encode the
drive-kind comparison; backup.Manager.namespaceRoot and stacks.Manager.inGuest delegate to
it. There were already TWO copies and they differed -- the backup package's compared without
filepath.Clean, the stacks package's with it, so a trailing slash from config would have
flipped the mode in one and not the other.

Sites routed through it:
  - stacks/deploy.go withPathVars -> ${USERDATA_PATH}   (the live defect)
  - appexport/fabplan.go + export.go                     (via a new provider method)
  - web/handlers.go FileBrowser mounts                   (latent: the system drive is
    deliberately never a registered StoragePath, so this is the identity today)

ComputeFabBuckets now receives the namespace root, which is what ComputeCaptureSet has always
received -- so the export's classified paths and the backup's capture set describe the same
directories by construction instead of by coincidence.

Tests are table-driven over BOTH drive kinds, because this survived by being invisible on the
kind that already worked. Red-proofs observed: restoring the bare-path call fails the
system-drive row with the two paths differing by /felhom-data; inverting the drive-kind
comparison fails every enrolled row.

controller/internal/web/handlers.go

@@ -2324,6 +2324,11 @@ func (s *Server) syncFileBrowserMounts(resetDBOnChange bool) {
 		classify:       s.classifyFSPath,
 		ensureSkeleton: s.ensureUserdataSkeleton,
 		logger:         s.logger,
+		// R-203. LATENT at this site rather than live: the comment below records that the system drive
+		// is deliberately never a registered StoragePath, so every `sp.Path` here is an enrolled drive
+		// and the resolver is the identity today. Wired anyway — the contract is uniform, and the next
+		// person to register a non-enrolled path should not have to rediscover this.
+		nsRootFor: func(p string) string { return appbackup.NamespaceRootFor(p, s.cfg.Paths.SystemDataPath) },
 	})
 
 	// R-75: the canonical drop-zone is an EXTRA bind, outside the registered-storage-path loop above.
@@ -2421,6 +2426,10 @@ type fbPathDeps struct {
 	isMount        func(string) bool   // drive-absent gate probe (production: system.IsMountPoint)
 	classify       func(string) string // network stub gate (production: Server.classifyFSPath; nil → include, fail open)
 	ensureSkeleton func(string) error  // userdata skeleton (production: appbackup.EnsureUserdataSkeleton) — DRIVES ONLY
+	// nsRootFor resolves a bare DRIVE path to its felhom-data namespace root (R-203). Injected rather
+	// than derived here because only the caller knows the system-data path. nil → identity, which is
+	// the pre-R-203 behaviour and correct for every enrolled drive.
+	nsRootFor func(string) string
 	logger         *log.Logger
 }
 
@@ -2480,7 +2489,14 @@ func buildFileBrowserPaths(paths []settings.StoragePath, d fbPathDeps) (storageM
 				d.logger.Printf("[WARN] [web] FileBrowser: could not ensure userdata skeleton on %s: %v", sp.Path, err)
 			}
 		}
-		userdataSrc := appbackup.UserdataDir(sp.Path)
+		// R-203: UserdataDir takes a NAMESPACE ROOT. On the system-data fallback a bare drive path is
+		// one segment short, so FileBrowser mounted a directory that is not the one the skeleton
+		// builder creates or the backup captures — the customer would browse an empty tree.
+		nsRoot := sp.Path
+		if d.nsRootFor != nil {
+			nsRoot = d.nsRootFor(sp.Path)
+		}
+		userdataSrc := appbackup.UserdataDir(nsRoot)
 		storageMounts = append(storageMounts, fmt.Sprintf("      - %s:/srv/%s", userdataSrc, mountName))
 	}
 	return storageMounts, configPaths