feat: add customer token support to API client

Extended path-based token selection to include customer tokens:
- /shop/* routes now use customer_token
- Fallback order: admin_token || vendor_token || customer_token

This ensures the correct token is used when logged into multiple
portals (admin, vendor, customer) simultaneously.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

static/shared/js/api-client.js

@@ -37,11 +37,13 @@ class APIClient {
      * Uses path-based detection to return the correct token:
      * - /admin/* routes use admin_token
      * - /vendor/* routes use vendor_token
-     * - Other routes fall back to admin_token || vendor_token
+     * - /shop/* routes use customer_token
+     * - Other routes fall back to admin_token || vendor_token || customer_token
      */
     getToken() {
         const adminToken = localStorage.getItem('admin_token');
         const vendorToken = localStorage.getItem('vendor_token');
+        const customerToken = localStorage.getItem('customer_token');
         const currentPath = window.location.pathname;
 
         let token;
@@ -54,15 +56,20 @@ class APIClient {
         } else if (currentPath.startsWith('/admin/') || currentPath.startsWith('/api/v1/admin/')) {
             token = adminToken;
             source = 'admin (path-based)';
+        } else if (currentPath.includes('/shop/') || currentPath.startsWith('/api/v1/shop/')) {
+            token = customerToken;
+            source = 'customer (path-based)';
         } else {
             // Default fallback for other paths
-            token = adminToken || vendorToken;
-            source = token === adminToken ? 'admin (fallback)' : 'vendor (fallback)';
+            token = adminToken || vendorToken || customerToken;
+            source = token === adminToken ? 'admin (fallback)' :
+                     token === vendorToken ? 'vendor (fallback)' : 'customer (fallback)';
         }
 
         apiLog.debug('Getting token:', {
             hasAdminToken: !!adminToken,
             hasVendorToken: !!vendorToken,
+            hasCustomerToken: !!customerToken,
             currentPath,
             source,
             usingToken: token ? source : 'none'