fix: resolve per-torrent qb save paths

docs/deployment-preflight.md

@@ -86,6 +86,9 @@ python3 scripts/preflight-deployment.py ... \
 - That future route path and qBittorrent content root use one client bind
   mount, so hard-link staging remains possible rather than silently falling
   back to a space-consuming copy.
+- Every explicit `qbittorrent.local_path_overrides` entry maps the same host
+  path in the qBittorrent and client containers. This protects nested qB save
+  paths that use a dedicated bind mount.
 - A real `link(2)` operation between a unique zero-byte file in the qB root
   and one in the future automatic-route root. The probe verifies that both
   names refer to the same inode and removes them unconditionally.
@@ -96,7 +99,8 @@ python3 scripts/preflight-deployment.py ... \
 - The token, qB password, and Syncthing API-key files are non-empty regular
   files with no group/world permissions.
 - The client image can read its configuration and reports usable permissions,
-  sparse-file support, and filesystem capabilities for both roots.
+  sparse-file support, and filesystem capabilities for both primary roots and
+  every configured qBittorrent local-path override.
 - qBittorrent authentication/version compatibility and Syncthing
   authentication/device identity are healthy from the client container.
 
@@ -106,6 +110,15 @@ root and add a `local_path_overrides` mapping for that exact API path. This
 prevents automatic route folders being created on a small configuration
 filesystem while the client expects to hardlink from the qB data mount.
 
+qBittorrent resources may use any `save_path` below `qbittorrent.api_root`.
+At job preflight the client maps that qB API path to its local mount and uses
+it as the resource root; data is never moved to fit Archive Control. A resource
+outside the configured qB API root, or whose resolved directory is unavailable
+or not a real directory in the client container, fails that job before staging
+or eviction. Use `qbittorrent.local_path_overrides` only for a nested qB API
+prefix backed by a distinct client mount; this preflight verifies the Docker
+bind topology for each such override.
+
 When converting an existing node, stop its client and Syncthing containers,
 move each existing `routes/<route-id>` directory from the old Syncthing config
 tree into the new qB-backed route-root directory, then recreate Syncthing and