Extend PrefixFilter with in and add storage mapping query as a consumer

[GregorShear]

Summary

Extends the shared PrefixFilter GraphQL input with an exact-set in predicate — an alternative to the existing startsWith subtree match (the two are mutually exclusive), letting prefix-scoped queries filter by an explicit set of prefixes. storageMappings gains a composable filter argument built on it, matching the pattern already used by inviteLinks (and the in-flight dataPlanes filter).

Groundwork for moving the UI's storage-mappings table (estuary/ui#2031) and flowctl onto the shared filter pattern.

PrefixFilter

Two scoping modes, mutually exclusive across every consumer:

input PrefixFilter {
  startsWith: String     # subtree match: acmeCo/ matches acmeCo/, acmeCo/team/, ...
  in: [String!]          # exact-set match: only the listed prefixes
}

For example, scope a query to an explicit set of prefixes (intersected with what the caller can read):

storageMappings(filter: { catalogPrefix: { in: ["acmeCo/", "betaCo/"] } })

• A prefix scope is always either a subtree (startsWith) or an exact set (in), never a mix; supplying both is a request error.
• An empty in: [] is rejected at input validation, rather than ambiguously meaning "nothing" or "everything".
• All three consumers — storageMappings, alertConfigs, inviteLinks — resolve their scope through one combinator, filtered_authorized_prefixes, which chains the mutual-exclusion check (PrefixFilter::into_parts), the authorized-prefix lookup, and the exact-set narrowing (PrefixFilter::narrow_to_exact_set). The narrow-only invariant — a filter can only remove authorized prefixes, never add them — has a single owner.

Deprecating storageMappings(by:)

storageMappings gains filter: { catalogPrefix }, deprecating by in its favor (underPrefix → startsWith, exactPrefixes → in). by maps onto the same PrefixFilter internally and stays until flowctl migrates (#3238).

Stack / follow-ups

• flowctl (flowctl: fetch storage mappings via GraphQL instead of PostgREST #3238): replace by: { exactPrefixes } with filter: { catalogPrefix: { in } }, stacked on this PR.
• UI (Migrate storage mappings table to GraphQL ui#2031): switch the storage-mappings table to filter: { catalogPrefix: { startsWith } } after a codegen refresh.

[jshearer]

LGTM % couple nits