Add customer accounts: login, signup, reset, activate, orders

- Storefront customer operations in graphql/customer.js and a server-safe
  services/shopify/customer.ts
- Session held in an httpOnly, sameSite=lax cookie set by the
  /api/account handlers; the access token never reaches client JS
- Pages: /account/login, /register, /recover, /reset/[id]/[token] and
  /activate/[id]/[token] for Shopify's emailed links
- /account renders order history as master-detail on one screen, since
  the Storefront API has no standalone order-by-id query for customers
- Header user icon: links to sign-in when signed out, otherwise a menu
  with name, email, order history, and sign out
- Login errors are collapsed and password recovery responds identically
  for known and unknown emails, so neither form enumerates accounts

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jWbNNJLksC1QG8z8845FX

services/shopify/session.ts

@@ -0,0 +1,31 @@
+// Customer session, stored in an httpOnly cookie. Server-only: importing this
+// from a client component will fail, which is deliberate — the access token
+// must never reach the browser's JavaScript.
+import { cookies } from 'next/headers';
+import { CUSTOMER_TOKEN_COOKIE } from '@/services/shopify/customer';
+
+export async function getSessionToken(): Promise<string | null> {
+  const store = await cookies();
+  return store.get(CUSTOMER_TOKEN_COOKIE)?.value ?? null;
+}
+
+export async function setSessionToken(
+  accessToken: string,
+  expiresAt: string
+): Promise<void> {
+  const store = await cookies();
+  const expires = new Date(expiresAt);
+
+  store.set(CUSTOMER_TOKEN_COOKIE, accessToken, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    expires: Number.isNaN(expires.getTime()) ? undefined : expires,
+  });
+}
+
+export async function clearSessionToken(): Promise<void> {
+  const store = await cookies();
+  store.delete(CUSTOMER_TOKEN_COOKIE);
+}