Serve UI extension source maps during app dev

[vividviolet]

WHY are these changes introduced?

Source maps stopped working for UI extensions in shopify app dev. The main asset is served from
https://localhost:3458/extensions/dev-<uuid>/assets/<target>/main.js and ends with a relative
//# sourceMappingURL=<handle>.js.map, so the browser requests
/assets/<target>/<handle>.js.map. Nothing emits that URL key, so the dev server 404'd it and
DevTools only ever showed minified output.

The map itself is generated — it just isn't in the directory the dev server reads from.
ExtensionInstance.keepBuiltSourcemapsLocally moves <handle>.js.map out of the bundle and
into the extension directory, which is what keeps .js.map files out of deploy bundles. That
invariant has to stay, so the fix is on the serving side only.

WHAT is this pull request doing?

• services/dev/extension/payload.ts: when a built asset has a source map in the extension
  directory, register it on the asset resolver under the key the relative sourceMappingURL
  resolves to (<target>/<handle>.js.map). It is not added to the payload's assets — it's a
  fetchable sibling, not a declared asset.
• services/dev/extension/server/middlewares.ts: resolve .js.map paths against the extension
  directory instead of the bundle (traversal guard follows the new root), and serve .map as
  application/json. .js.map requests without a resolver entry 404, so the resolver remains the
  allowlist for this route and the extension directory isn't otherwise readable.

No build step changes, so nothing new can reach a deploy bundle. .js.map is unambiguous as a
marker here because deploy bundles exclude those files unconditionally
(BUNDLE_EXCLUSION_PATTERNS).

How to test your changes?

1. shopify app dev with an app that has an admin UI extension.
2. Open the extension in Admin and check the Network tab: the .js.map request should be 200
   (application/json) and DevTools Sources should show the original TSX.
3. Edit a source file so the extension rebuilds, then confirm the map still resolves.

Automated coverage (real temp dirs, no fs mocking):

• payload.test.ts — map registered when present, not registered when absent.
• middlewares.test.ts — a registered map is served from the extension directory while the bundle
  dir is deliberately map-free (so it also pins "not served from the bundle"); an unregistered
  .js.map 404s.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch) and added a changeset