Resolve slug redirect path

Read-only public-path resolver used before front-end page rendering so changed slug, entity-family, and Business Line parent-family URLs return a permanent HTTP redirect to the current canonical public path, while missing slug URLs return a real 404 before the App Router starts streaming. One profile sub-path segment is preserved across family redirects; the front-end owns the tab inventory. Direct product/service alias paths /companies/products-services/{slug} return 204 for a public Product/Service with a non-hidden eligible provider, with curated alias redirect rows taking precedence; a 404 on a slug-backed path can also mean the record exists but is not yet publicly visible. Bearer access requires ROLE_ADMIN or ROLE_CLIENT.