feat: storefront subscription access guard + module-driven nav + URL rename

Add StorefrontAccessMiddleware that blocks storefront access for stores
without an active subscription, returning a multilingual unavailable page
(en/fr/de/lb) for page requests and JSON 403 for API requests. Multi-platform
aware: resolves subscription for detected platform with fallback to primary.

Also includes yesterday's session work:
- Module-driven storefront navigation via FrontendType.STOREFRONT menu declarations
- shop/ → storefront/ URL rename across 30+ templates
- Subscription context (tier_code) passed to storefront templates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/catalog/definition.py

@@ -125,6 +125,36 @@ catalog_module = ModuleDefinition(
                 ],
             ),
         ],
+        FrontendType.STOREFRONT: [
+            MenuSectionDefinition(
+                id="nav",
+                label_key=None,
+                order=10,
+                items=[
+                    MenuItemDefinition(
+                        id="products",
+                        label_key="storefront.nav.products",
+                        icon="shopping-bag",
+                        route="storefront/products",
+                        order=10,
+                    ),
+                ],
+            ),
+            MenuSectionDefinition(
+                id="actions",
+                label_key=None,
+                order=10,
+                items=[
+                    MenuItemDefinition(
+                        id="search",
+                        label_key="storefront.actions.search",
+                        icon="search",
+                        route="",
+                        order=10,
+                    ),
+                ],
+            ),
+        ],
     },
     # Metrics provider for dashboard statistics
     metrics_provider=_get_metrics_provider,