scanMetadataFiles should ignore @slot and _private directories

[NathanDrake2406]

Summary

scanMetadataFiles() currently recurses into every directory except route groups, so metadata files under parallel-route slots and private folders become public metadata URLs.

Reproduction

Given an app dir with:

app/
  @slot/icon.png
  _private/icon.png

scanMetadataFiles(appDir) currently returns routes with:

• servedUrl: "/@slot/icon"
• servedUrl: "/_private/icon"

Expected

• @slot directories should not produce public metadata URL segments. They are parallel-route internals, not part of the URL space.
• _private directories should be skipped entirely, matching Next.js private-folder behavior.

Why this looks wrong

• The app router scanner already excludes @slot and _private directories when discovering routes.
• isInvisibleSegment() already treats @slot segments as invisible in URLs.
• Next.js private folders opt the folder and its subfolders out of routing: https://nextjs.org/docs/app/getting-started/project-structure#private-folders

Likely fix

Teach scanMetadataFiles() to:

1. Skip _private directories entirely
2. Recurse into @slot directories without adding them to urlPrefix
3. Add coverage in tests/metadata-routes.test.ts for both cases