Load page.json by import, publish via fs, drop cookie auth

The editor no longer round-trips through /api/pages. Each route's
editor/page.tsx imports its own `../page.json` and hands it to
PageEditor as a prop, so the editor opens with the page already in
hand — no fetch, no loading state, no undo history seeded from a
placeholder. Globals still come from app.globals.json.

Publishing moves from `PUT /api/pages` to a `publishPage` server
action that writes the route's page.json with node:fs directly.
The target path is still built from the lib/pages.ts registry rather
than from the caller, so an unknown route key is rejected instead of
escaping app/.

Removes the customer account auth entirely: the httpOnly cookie
session, the /api/account/* handlers, the customer service and
GraphQL documents, the account-* blocks, and the /account/* routes.
The template has no auth, so nothing reads a cookie now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01STGDvL4X7FhHHnxdRE2ayo

lib/pages.ts

@@ -3,8 +3,8 @@
  *
  * `key` is what the editor's page picker shows and what `onPublish` hands back;
  * `dir` is the folder under `app/` holding that route's `page.json`. Keeping
- * the list here means the publish API can validate a request against it rather
- * than trusting a path from the browser.
+ * the list here means the publish action can validate a route key against it
+ * rather than trusting a path from the browser.
  */
 export interface PageRoute {
   key: string;
@@ -29,28 +29,6 @@ export const PAGE_ROUTES: PageRoute[] = [
   },
   { key: '/search', label: 'Search', dir: 'search' },
   { key: '/policies/[handle]', label: 'Policy', dir: 'policies/[handle]' },
-  { key: '/account', label: 'Account — orders', dir: 'account' },
-  { key: '/account/login', label: 'Account — sign in', dir: 'account/login' },
-  {
-    key: '/account/register',
-    label: 'Account — register',
-    dir: 'account/register',
-  },
-  {
-    key: '/account/recover',
-    label: 'Account — recover',
-    dir: 'account/recover',
-  },
-  {
-    key: '/account/reset/[id]/[token]',
-    label: 'Account — set password',
-    dir: 'account/reset/[id]/[token]',
-  },
-  {
-    key: '/account/activate/[id]/[token]',
-    label: 'Account — activate',
-    dir: 'account/activate/[id]/[token]',
-  },
 ];
 
 export const ROUTE_KEYS = PAGE_ROUTES.map((route) => route.key);