chore(dev): make the plugin bundle debuggable in Obsidian

[luoxuanzao]

Summary

• What changed? Breakpoints in an attached Chromium debugger now resolve to Qoderian sources during development.
  • esbuild.config.mjs: new dev-only exposeDevSourceMapToDebugger plugin rewrites main.js into an eval wrapper so sourceMappingURL lands after sourceURL — the order Chromium requires to associate a map. The two directives are assembled from split string literals at runtime so Obsidian's source scanner cannot strip them while reading the wrapper.
  • scripts/dev-reloader/main.js: during a reload, temporarily sets localStorage['debug-plugin'] and guards vault.adapter.read to append a /* nosourcemap */ marker to the target plugin's main.js, bypassing Obsidian's directive stripping. Previous values are restored in a finally; the restore is idempotent, so the failure path calling it twice is a no-op.
  • scripts/renderer-safe-unref.js: the SDK timer patches run after esbuild emits its source map, so any change in length shifted every mapping that followed. New preserveFollowingGeneratedPositions keeps the matched region's newline count and ending column intact.
  • .vscode/launch.json (new) + .gitignore: share the "Attach to Obsidian" config (127.0.0.1:9222, app://obsidian.md/*) by allowing that one file through the ignore rule.
• Why is it needed? Obsidian appends its own sourceURL after plugin code and strips sourceMappingURL directives, so the inline map esbuild emitted was invisible to the debugger. Combined with the position-shifting SDK patches, dev-time debugging of the renderer was effectively unusable.

Production output is untouched — the wrapper plugin is registered only when prod is false.

Verification

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• npm run release:check
• npm run audit:prod — fails on pre-existing transitive advisories (fast-uri high, qs moderate). This branch touches no package.json/lockfile, so the failure is inherited from main, not introduced here.
• Tested affected qodercli behavior against a real CLI when applicable — N/A, no CLI behavior changes. Manual verification of breakpoints in a real Obsidian instance is still welcome before merge.

Safety

• No credentials, private vault content, internal URLs, or personal paths are included — launch.json references only 127.0.0.1:9222 and ${workspaceFolder}.
• User-visible changes are documented in CHANGELOG.md — dev-only tooling with no user-visible behavior change, so CHANGELOG.md was not updated. Say the word if you'd rather have an entry.