[Storage] Add embedded site OPFS locator

[ashfame]

What

Adds a constrained OPFS locator for sites managed by embedding applications:

• getExistingEmbeddedSiteOpfsDirectoryHandle(storageKey) is public and only opens an existing directory.
• getOrCreateEmbeddedSiteOpfsDirectoryHandle(storageKey) is private to browser-fs.ts and is used by mount handling.
• opfs-paths.ts owns both the website-managed /sites root and embedded-site /embedded-sites root, plus the internal embedded-site path derivation.

Adds an opfs-embedded-site mount device that accepts the same opaque storage key. remote.html already resolves mounts through directoryHandleFromMountDevice(), which now uses the private get-or-create operation.

Why

An embedding that persists a Playground through remote.html and later reads it through a lightweight api.html needs both endpoints to locate the same directory by storage key. Creation policy should not be a caller-controlled boolean: mount handling must create the directory, while a consumer must never turn an unknown key into an empty site.

This is intentionally a small precursor to #4095. That PR can call getExistingEmbeddedSiteOpfsDirectoryHandle(storageKey) and pass the returned handle to its ZIP implementation.

The website-specific opfsSiteStorage.exportSavedSiteAsZip(slug) remains unchanged. It is coupled to the website's /sites namespace, slug lookup, and wp-runtime.json completeness metadata, so it is not the exporter for embedded sites.

Impact

Embedders can persist a site through startPlaygroundWeb() with:

mounts: [
	{
		device: {
			type: 'opfs-embedded-site',
			storageKey,
		},
		mountpoint: '/wordpress',
		initialSyncDirection: 'memfs-to-opfs',
	},
]

Before removing the Playground iframe, callers should use await playground.flushOpfs('/wordpress') or await playground.unmountOpfs('/wordpress') to ensure pending changes have reached OPFS.

The later lightweight API can locate the persisted directory with:

const directory =
	await getExistingEmbeddedSiteOpfsDirectoryHandle(storageKey);

Existing raw opfs path mounts are unchanged. Website and Personal WP site storage now share the canonical /sites root exported by the storage package.

Testing

• npm exec nx test playground-storage
• npm exec nx lint playground-storage
• npm exec nx build playground-storage
• npm exec nx build playground-client
• npm exec nx typecheck playground-personal-wp
• npm exec nx lint playground-personal-wp
• npm exec nx typecheck playground-website
• npm exec nx lint playground-website
• npm exec nx test playground-website