List product locations

## Get product locations (apps) Returns the apps (referred to here as locations) linked to the given product. Each entry is projected to `{ Id, Name }`. ### Authentication Requires a Merchant API key in `x-api-key` with scope `Merchant.product.read`. ### Path params - `productId` (required) — the product UUID. ### Behavior - Validates the product exists in your store (400 `Product with id <productId> not found` otherwise). - Returns an array of `{ Id, Name }` app objects. --- **Notas:** The route is named /locations but returns linked apps (join table productApps -> apps), projected to Id + Name. Returns a bare array. Product must belong to the caller's store.