fix(vite): serve pnpm-isolated transitive deps over /ns/m - #11475

PR Checklist

• The PR title follows our guidelines.
• Issue filed: vite: /ns/m dev server 404s on pnpm-isolated transitive dependencies #11470
• CLA signed.
• All existing tests are passing — see testing note.
• Tests for the changes are included.

What is the current behavior?

Under pnpm's nodeLinker: isolated, a workspace package's own dependency lives in that package's private node_modules (e.g. packages/gif/node_modules/@nativescript-community/ui-image), not under the app root or the hoisted workspace root. Three compounding gaps make such deps unserveable over /ns/m:

1. resolveCandidateFilePath only probes projectRoot and workspaceRoot, so the file lookup misses → 404.
2. resolveVendorRouting sends plugin-patterned package entries (e.g. ui-image's index.ios.js main) down the vendor: route even when the package isn't in the vendor manifest — the sync require then resolves to the missing-module stub instead of falling back to HTTP serving.
3. createNsMRequestContext's candidate list never probes platform-suffixed files (index.ios.js), so a plugin's main: './index' entry can't resolve at all in per-module serving.

On device: HTTP import failed / network error during dev-session boot. Repro with a real package set: any pnpm-isolated monorepo where an app imports a workspace package whose dependency is a NativeScript plugin.

What is the new behavior?

• resolveCandidateFilePath gains a cached, best-effort fallback that probes every workspace package's node_modules for the <pkg>/<sub> tail of the URL (the importer is dropped by the URL form, so first-hit wins — pnpm guarantees the dep lives under exactly one package's private dir).
• resolveVendorRouting only takes the vendor: route for plugin-patterned packages when the package actually exists in the active vendor manifest; otherwise it falls through to the per-module HTTP path. A null manifest (early boot) keeps the legacy behavior.
• createNsMRequestContext expands candidates with the active platform's suffixes (ios/android/visionos/native) before the unsuffixed variants — existence-filtered downstream, so probing is safe.

Fixes #11470.

Testing note

Added resolveCandidateFilePath specs covering the pnpm-isolated hit, root priority, and the miss path. Verified end-to-end as a pnpm patch on 8.0.11: an app whose dev boot previously died on @nativescript-community/ui-image now serves the full module graph. Minimal standalone repro: https://github.com/aleclarson/repro/tree/nativescript-11470