Get Binding For Path

Path-identified lookup — symmetric to GET /by-remote.

Path-only bindings are per-user (m1), so this lookup is naturally scoped to the caller's own row: a coincidentally-identical absolute path belonging to another user simply 404s. The M1 visibility check still applies (the lookup could still hit a public workspace bound by someone else via path-only) — kept for defense-in-depth even though the scoping already excludes cross-user hits.