R-102 phase 1.1: split the recovery-unit path helpers, zero behaviour change

Every unit path helper took (nsRoot, stackName) and joined backups/primary/<stack>/... . That
hard-coded 'primary' is the mechanism of R-102: Tier-2 mirrors the whole unit directory to
<dest>/backups/secondary/<stack>/recovery-unit/ every night, and because no reader could NAME a
unit outside backups/primary/, that mirror has been captured for months and read by nothing.

Adds four unit-directory-relative primitives - UnitComposeDir, UnitManifestFile, UnitDBDumpDir,
UnitVolumeDumpDir - each taking the recovery-unit DIRECTORY itself. The four existing
(nsRoot, stackName) helpers become thin wrappers over them and keep their exact signatures and
their exact return values; every current caller compiles untouched.

ONE implementation, two callers - the rule restoreDockerVolumesFrom already follows in this repo.

TestR102_PathWrappersAreByteIdenticalToToday pins the wrappers against hand-written literals (not
re-derived from the helpers under test). Red-proof: UnitComposeDir join changed to 'compose2' ->
the test fails on all three fixtures.

controller/internal/backup/appbackup_bridge.go

@@ -156,6 +156,18 @@ func RecoveryUnitManifestPath(nsRoot, stackName string) string {
 	return appbackup.RecoveryUnitManifestPath(nsRoot, stackName)
 }
 
+// The four UNIT-DIRECTORY-RELATIVE helpers (R-102). They take the recovery-unit DIRECTORY itself, so
+// a reader can name a unit that is NOT under backups/primary/ — the Tier-2 mirror at
+// <dest>/backups/secondary/<stack>/recovery-unit/ being the whole point.
+
+func UnitComposeDir(unitDir string) string { return appbackup.UnitComposeDir(unitDir) }
+
+func UnitManifestFile(unitDir string) string { return appbackup.UnitManifestFile(unitDir) }
+
+func UnitDBDumpDir(unitDir string) string { return appbackup.UnitDBDumpDir(unitDir) }
+
+func UnitVolumeDumpDir(unitDir string) string { return appbackup.UnitVolumeDumpDir(unitDir) }
+
 func AppDataDir(nsRoot, stackName string) string {
 	return appbackup.AppDataDir(nsRoot, stackName)
 }