feat: storefront subscription access guard + module-driven nav + URL rename

Add StorefrontAccessMiddleware that blocks storefront access for stores
without an active subscription, returning a multilingual unavailable page
(en/fr/de/lb) for page requests and JSON 403 for API requests. Multi-platform
aware: resolves subscription for detected platform with fallback to primary.

Also includes yesterday's session work:
- Module-driven storefront navigation via FrontendType.STOREFRONT menu declarations
- shop/ → storefront/ URL rename across 30+ templates
- Subscription context (tier_code) passed to storefront templates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/orders/definition.py

@@ -137,6 +137,22 @@ orders_module = ModuleDefinition(
                 ],
             ),
         ],
+        FrontendType.STOREFRONT: [
+            MenuSectionDefinition(
+                id="account",
+                label_key=None,
+                order=10,
+                items=[
+                    MenuItemDefinition(
+                        id="orders",
+                        label_key="storefront.account.orders",
+                        icon="clipboard-list",
+                        route="storefront/account/orders",
+                        order=40,
+                    ),
+                ],
+            ),
+        ],
     },
     is_core=False,
     # =========================================================================