Rebind By Path

Path-identified rebind — symmetric to PUT /by-remote for projects without a git remote (materialized sample scaffolds, fresh scratch dirs). Same FOR UPDATE + optimistic-concurrency semantics as its remote sibling, same both-sides authorization, same in-place mutation of the binding row.

Path-only bindings are scoped by user, so the FOR UPDATE lookup passes the caller's user_id — a coincidentally-matching path belonging to another user will simply 404.