fix(graph): make plugin-alias gate segment-aware so bare "@" alias no longer swallows @scope/* deps

[BartWaardenburg]

In crates/graph/src/resolve/specifier.rs, the matches_plugin_alias predicate used specifier.starts_with(prefix), which caused a bare "@" alias to match every @scope/pkg specifier. A new helper specifier_matches_alias_prefix adds segment-aware logic mirroring fallbacks.rs::alias_match_remainder: the match is accepted only when the remainder after stripping the prefix is empty, the prefix already ends with /, or the remainder starts with /. This means prefix = "@" only matches the exact string "@" or "@/...", never "@radix-ui/react-checkbox". The helper is used at both call sites of matches_plugin_alias in specifier.rs.

Review

Verdict: SHIP

• Minor (non-blocking): boundary logic is duplicated between fallbacks.rs::alias_match_remainder (Option<&str>) and the new specifier.rs::specifier_matches_alias_prefix (bool). They could drift; rule-of-three not yet met so acceptable, but a shared helper is worth considering if a third call site appears.
• Working tree note (not part of this diff): unrelated changes exist in crates/extract/src/visitor/helpers.rs and crates/extract/src/tests/js_ts/classes.rs (class-member prop.declare handling). These were introduced by parallel-agent activity, are NOT in the Bare "@" alias key flags every @scope/* dependency as unused + unresolved #838 patch, and must not be co-committed with this fix. Commit scope is limited to crates/graph/src/resolve/{specifier.rs,tests.rs}.

Closes #838