feat: storefront subscription access guard + module-driven nav + URL rename

Add StorefrontAccessMiddleware that blocks storefront access for stores
without an active subscription, returning a multilingual unavailable page
(en/fr/de/lb) for page requests and JSON 403 for API requests. Multi-platform
aware: resolves subscription for detected platform with fallback to primary.

Also includes yesterday's session work:
- Module-driven storefront navigation via FrontendType.STOREFRONT menu declarations
- shop/ → storefront/ URL rename across 30+ templates
- Subscription context (tier_code) passed to storefront templates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/cart/definition.py

@@ -6,7 +6,13 @@ This module provides shopping cart functionality for customer storefronts.
 It is session-based and does not require customer authentication.
 """
 
-from app.modules.base import ModuleDefinition, PermissionDefinition
+from app.modules.base import (
+    MenuItemDefinition,
+    MenuSectionDefinition,
+    ModuleDefinition,
+    PermissionDefinition,
+)
+from app.modules.enums import FrontendType
 
 # =============================================================================
 # Router Lazy Imports
@@ -53,7 +59,24 @@ cart_module = ModuleDefinition(
         ),
     ],
     # Cart is storefront-only - no admin/store menus needed
-    menu_items={},
+    menus={
+        FrontendType.STOREFRONT: [
+            MenuSectionDefinition(
+                id="actions",
+                label_key=None,
+                order=10,
+                items=[
+                    MenuItemDefinition(
+                        id="cart",
+                        label_key="storefront.actions.cart",
+                        icon="shopping-cart",
+                        route="storefront/cart",
+                        order=20,
+                    ),
+                ],
+            ),
+        ],
+    },
 )