Preserve qualified source URIs and prevent slide-ID collisions

[CraigMyles]

Summary

• preserve HTTP, object-store, and explicit file:// source URIs verbatim in store
  headers and receipts
• keep qualified manifest entries unchanged while resolving only relative plain paths
  against slide_dir
• derive stable, readable remote slide IDs with a 16-hex SHA-256 fingerprint of the
  exact source URI
• use the parent store name for numeric series paths such as image.zarr/0
• cap readable remote ID prefixes so generated store filenames remain safely below
  common filesystem limits

Why

Qualified sources were passed through local-path handling in several places. This could
produce malformed provenance such as file:///.../https:/..., prepend slide_dir to
URI manifest entries, and allow unrelated remote slides with common basenames or terminal
components such as 0 to target the same output store.

Compatibility

Ordinary local paths retain the v0.1 behavior:

• provenance remains file:// plus os.path.abspath(...)
• existing basename and case-sensitive suffix-derived slide IDs are unchanged

Explicit file:// inputs are preserved as supplied and derive their IDs from the decoded
URI path.

The deliberate local naming exception is a bare image-series path such as
.../image.zarr/0, which now produces a readable, fingerprinted ID rather than 0.

Remote fingerprints hash the exact preserved URI text. Query strings, fragments,
trailing slashes, and case-sensitive user information therefore participate in identity
but do not appear in the readable filename prefix.

Validation

• 340 passed, 50 deselected in the full non-slow suite after rebasing onto merged
  PR Fix multi-grid standalone slide embedding #7, on Linux/Python 3.12 with the optional dependencies installed
• 24 passed in tests/test_source_uris.py, covering HTTP, HTTPS, S3, GS, explicit
  file URIs, query strings, fragments, trailing slashes, userinfo casing, manifests,
  headers, receipts, local compatibility, numeric-series paths, collision cases, and
  filename length
• ruff check . passes
• independent code review found no remaining blockers

Closes #3
Part of #6

[CraigMyles]

Verified before merge: for plain local paths, slide_id and the file:// provenance are byte-identical to pre-PR (differential old-vs-new check across local inputs), so existing stores resume unaffected. The only local ID that changes is the degenerate bioformats2raw series case .../*.zarr/<index>, which previously collapsed to slide_id="0". Remote URIs (http/https/s3/gs and explicit file://) are now preserved verbatim in headers, receipts, and manifests. 24 new + 27 existing tests pass, CI green.

Scope note: this fixes provenance and IDs only. It does not add remote reading, the reader still opens the source path directly, so s3:///gs:// inputs actually opening is a separate follow-up, not enabled here.