fix(flr): resolve guest paths into the FLR partition namespace

zerto_recover_file passed the guest absolute path straight to
POST /v1/flrs/{session}/download, which the ZVM rejects:

  HTTP 400 {"Message":"Invalid path: check location exists or
  correct path syntax."}

FLR browse/download is rooted at partitions, not the guest's /.
/home/justin/app-config.yaml is Volume2-Ext4/home/justin/app-config.yaml.
server.py already called browse_flr() but discarded the result, so
nothing ever resolved the path.

Add resolve_flr_path() and browsable_partitions() to recover.py:

- browse path "" returns {MainPathItem, PathItems}, not a bare list
- skip partitions with IsBrowsable false. A Linux guest reports
  Volume1-Unknown as "Cannot restore. Partition type Unknown is not
  supported." Do not assume the first partition is the right one.
- browse returns child paths percent-encoded
  (Volume2-Ext4%2fhome%2fjustin%2fapp-config.yaml); download wants
  them decoded with plain slashes
- raise a ZertoError naming what was searched when the file is
  absent, since "not replicated into that checkpoint yet" is the
  likely cause and is actionable

zerto_recover_file now returns the resolved flr_path.

Verified end to end against ZVM 10.x: guard tagged cp 1075 on VPG
jp-ubuntu, FLR mounted in ~3s, 158 bytes recovered from the
pre-mutation checkpoint with matching content.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_016yVfC5nvZowoLFnEGWhLGn

src/zerto_rewind_mcp/recover.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+import urllib.parse
 from typing import Any
 
 from zerto_rewind_mcp.client import ZertoClient, ZertoError
@@ -94,3 +95,61 @@ async def wait_flr_ready(
         f"FLR session {session_id} not ready within {timeout_s:.0f}s (last={last!r}). "
         "Retry browse after a minute, or check EJC is not running and no clone/test is active."
     )
+
+
+def _decode_flr_path(value: Any) -> str:
+    """Browse returns paths percent-encoded (%2f). Download wants them decoded."""
+    return urllib.parse.unquote(str(value or "")).replace("\\", "/")
+
+
+def path_items(payload: Any) -> list[dict[str, Any]]:
+    if isinstance(payload, dict):
+        items = payload.get("PathItems") or payload.get("pathItems") or []
+        return [i for i in items if isinstance(i, dict)]
+    if isinstance(payload, list):
+        return [i for i in payload if isinstance(i, dict)]
+    return []
+
+
+async def browsable_partitions(client: ZertoClient, session_id: str) -> list[str]:
+    """FLR is rooted at partitions (Volume2-Ext4), not the guest's /.
+
+    Volume1-Unknown and friends report IsBrowsable false and cannot be restored.
+    """
+    rows = path_items(await client.browse_flr(session_id, path=""))
+    return [str(r.get("Path")) for r in rows if r.get("IsBrowsable")]
+
+
+async def resolve_flr_path(client: ZertoClient, session_id: str, guest_path: str) -> str:
+    """Map a guest absolute path to the FLR namespace path the download API accepts.
+
+    /home/justin/app-config.yaml -> Volume2-Ext4/home/justin/app-config.yaml
+    """
+    rel = guest_path.replace("\\", "/").strip("/")
+    if not rel:
+        raise ZertoError("Empty guest_path")
+    parts = rel.split("/")
+    name, parent = parts[-1], "/".join(parts[:-1])
+
+    partitions = await browsable_partitions(client, session_id)
+    if not partitions:
+        raise ZertoError(
+            "FLR mounted but no browsable partition. Unsupported partition type "
+            "(LVM/unknown) cannot be restored by FLR."
+        )
+    tried = []
+    for vol in partitions:
+        probe = f"{vol}/{parent}" if parent else vol
+        tried.append(probe)
+        try:
+            rows = path_items(await client.browse_flr(session_id, path=probe))
+        except ZertoError:
+            continue
+        for row in rows:
+            decoded = _decode_flr_path(row.get("Path"))
+            if decoded.rsplit("/", 1)[-1] == name:
+                return decoded
+    raise ZertoError(
+        f"{guest_path!r} not found in the FLR mount. Looked under {tried}. "
+        "The file may not have replicated into that checkpoint yet."
+    )