docs: add consolidated dev URL reference and migrate /shop to /storefront

- Add Development URL Quick Reference section to url-routing overview
  with all login URLs, entry points, and full examples
- Replace /shop/ path segments with /storefront/ across 50 docs files
- Update file references: shop_pages.py → storefront_pages.py,
  templates/shop/ → templates/storefront/, api/v1/shop/ → api/v1/storefront/
- Preserve domain references (orion.shop) and /store/ staff dashboard paths
- Archive docs left unchanged (historical)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/backend/middleware-reference.md

@@ -92,7 +92,7 @@ Centralized class for detecting which frontend a request targets based on URL pa
 2. Path-based detection:
    - `/admin/*`, `/api/v1/admin/*` → ADMIN
    - `/store/*`, `/api/v1/store/*` → STORE
-   - `/storefront/*`, `/shop/*`, `/stores/*` → STOREFRONT
+   - `/storefront/*`, `/stores/*` → STOREFRONT
    - `/api/v1/platform/*` → PLATFORM
 3. Store subdomain → STOREFRONT
 4. Store context set → STOREFRONT
@@ -210,17 +210,17 @@ Middleware for request/response logging and performance monitoring.
 
 **Modern Approach: Double Router Mounting**
 
-Instead of using middleware to rewrite paths, the application registers shop routes **twice** with different prefixes:
+Instead of using middleware to rewrite paths, the application registers storefront routes **twice** with different prefixes:
 
 ```python
 # In main.py
-app.include_router(shop_pages.router, prefix="/shop")
-app.include_router(shop_pages.router, prefix="/stores/{store_code}/shop")
+app.include_router(storefront_pages.router, prefix="/storefront")
+app.include_router(storefront_pages.router, prefix="/stores/{store_code}/storefront")
 ```
 
 **How It Works:**
-- **Subdomain/Custom Domain Mode**: Routes match `/shop/*` prefix
-- **Path-Based Development Mode**: Routes match `/stores/{store_code}/shop/*` prefix
+- **Subdomain/Custom Domain Mode**: Routes match `/storefront/*` prefix
+- **Path-Based Development Mode**: Routes match `/stores/{store_code}/storefront/*` prefix
 - FastAPI handles routing naturally without path manipulation
 - Store code is available as a path parameter when needed
 

docs/backend/overview.md

@@ -14,13 +14,13 @@ app/
 │   ├── v1/                # Version 1 API
 │   │   ├── admin/        # Admin API endpoints
 │   │   ├── store/       # Store API endpoints
-│   │   └── shop/         # Shop API endpoints
+│   │   └── storefront/   # Storefront API endpoints
 │   └── main.py           # API router configuration
 │
 ├── routes/               # Page routes (HTML)
 │   ├── admin_pages.py   # Admin page routes
 │   ├── store_pages.py  # Store page routes
-│   └── shop_pages.py    # Shop page routes
+│   └── storefront_pages.py    # Storefront page routes
 │
 ├── services/            # Business logic layer
 │   ├── admin_service.py
@@ -84,7 +84,7 @@ class ProductService:
 
 product_service = ProductService()
 
-# Step 3: API Route (app/api/v1/shop/products.py)
+# Step 3: API Route (app/api/v1/storefront/products.py)
 from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session
 from app.core.database import get_db

docs/backend/store-in-token-architecture.md

@@ -365,12 +365,12 @@ The following permission dependencies now use token-based store context:
 - `require_all_store_permissions()` - Gets store from token, sets `request.state.store`
 - `get_user_permissions` - Gets store from token, sets `request.state.store`
 
-### Shop Endpoints
-Shop endpoints (public, no authentication) still use `require_store_context()`:
-- `app/api/v1/shop/products.py` - Uses URL/subdomain/domain detection
-- `app/api/v1/shop/cart.py` - Uses URL/subdomain/domain detection
+### Storefront Endpoints
+Storefront endpoints (public, no authentication) still use `require_store_context()`:
+- `app/api/v1/storefront/products.py` - Uses URL/subdomain/domain detection
+- `app/api/v1/storefront/cart.py` - Uses URL/subdomain/domain detection
 
-This is correct behavior - shop endpoints need to detect store from the request URL, not from JWT token.
+This is correct behavior - storefront endpoints need to detect store from the request URL, not from JWT token.
 
 ## Benefits of Store-in-Token