fix(#1675): serve QA tutorial navigator at /tutorial-navigator-qa/

[jung-thomas]

Fixes #1675.

Diagnosis

• /tutorial-navigator-qa/ returns 404 because there is no approuter route for it. That's the genuine defect (matches the issue title).
• The other reported "~638-byte stubs" for /tutorials-qa/* are the XSUAA gate responding to the reporter's unauthenticated curl — every /tutorials-qa/* route is Tutorial.Author-scoped, so anonymous requests get a tiny stub. They serve real content when logged in. The QA navigator itself already renders at /tutorials-qa/ (the QA root uses the navigator layout, served statically).

Fix (mirrors prod's #1659 Phase-2 CAP flip, for the QA channel)

Prod serves its navigator from the page-tutorial-navigator HANA BLOB via CAP /content/pages/tutorial-navigator/. srv-qa already serves /content/pages/* (dark-launched in #1659) but nothing reached it. This wires it up:

1. scripts/fetch-tutorials.ts — on the QA channel, also emit content-qa/tutorial-navigator/_index.md (new qaNavigatorPageMarkdown(), identical navigator layout to the QA root) so build:qa produces public-qa/tutorial-navigator/index.html. publish-content:qa then discovers it via discoverPageFiles and uploads page-tutorial-navigator to tutorials-hana-qa — no publish-path code change needed.
2. approuter/xs-app.json — add ^/tutorial-navigator-qa/?(\?.*)?$ → srv-qa-api /content/pages/tutorial-navigator/$1, authenticationType: xsuaa, scope: $XSAPPNAME.Tutorial.Author. The -qa in the regex guarantees it never clobbers the public prod /tutorial-navigator/ route.
3. srv-qa/server.js — un-dark-launch note on the /content/pages/* route.
4. scripts/verify-qa-build.ts — assert public-qa/tutorial-navigator/index.html exists and carries the QA navigator markers (reuses checkQaIndex).

Tests

• qaNavigatorPageMarkdown unit test (same navigator frontmatter as the root).
• Dedicated approuter route unit test — scope/target + regex guard proving the QA route matches /tutorial-navigator-qa/ but not prod /tutorial-navigator/.
• QA smoke assertions (self-skip without QA env): authed GET /tutorial-navigator-qa/ → 200 + navigator markers (quote-agnostic for --minify); unauth → 401/302; direct srv-qa /content/pages/tutorial-navigator/ anon → 401.

Verified end-to-end locally: ran the QA Hugo build with the generated sources → public-qa/tutorial-navigator/index.html renders with data-search-base=/qa-search, data-nav-base=/tutorials-qa, data-href-base=/tutorials-qa, populated #browse-data; checkQaIndex passes; discoverPageFiles('hugo/public-qa') returns page-tutorial-navigator. Unit suites: 59 passed.

Rollout

Requires both: (a) a QA content rebuild (rebuild-content-qa.yml, publishes page-tutorial-navigator to tutorials-hana-qa) and (b) a full MTA deploy (ships the new approuter route). Before the QA publish lands, the route fail-opens to the prod page-fallback snapshot under Author scope — transient, not broken.