[aft-alfonso]

Two fixes found while diagnosing the #984 merge-group failures.

• Fresh subc bind actors (and actors recreated for a previously live root) started from Config::default(), so a module started with an explicit storage path (library, CLI and test fixtures) split its data between that path and the default data home. Actors now start from the storage root the module selected at startup, the one its daemon storage lease covers. Users choose storage with AFT_STORAGE_DIR, which already applied to both, so nothing changes for them.
• Call-ledger recovery settles every unsettled row in aft.db, and standalone processes ran it too when a project was configured, so a standalone OpenCode or Pi session sharing storage with the daemon could settle the daemon's in-flight calls as not_started or unknown. Only the subc module, the one process that admits ledger rows, now runs recovery. The comment at recover() records the remaining limit: one module process per aft.db; two modules sharing a root would need an owner column first.

Tests: a fresh bind actor's SQLite file is under the module's storage root; a standalone configure leaves another process's Prepared and DispatchStarted rows untouched, and the provider process still recovers them.