fix: storefront login 403, cookie path, double-storefront URLs, and auth redirects

- Extract store/platform context from Referer header for storefront API requests
  (StoreContextMiddleware and PlatformContextMiddleware) so login POST works in
  dev mode where API paths lack /platforms/{code}/ prefix
- Set customer token cookie path to "/" for cross-route compatibility
- Fix double storefront in URLs: replace {{ base_url }}storefront/ with {{ base_url }}
  across all 24 storefront templates
- Fix auth error redirect to include platform prefix and use store_code
- Update seed script to output correct storefront login URLs
- Add 20 new unit tests covering all fixes; fix 9 pre-existing test failures

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/customers/routes/api/storefront.py

@@ -178,23 +178,8 @@ def customer_login(
         },
     )
 
-    # Calculate cookie path based on store access method
-    store_context = getattr(request.state, "store_context", None)
-    access_method = (
-        store_context.get("detection_method", "unknown")
-        if store_context
-        else "unknown"
-    )
-
-    cookie_path = "/storefront"
-    if access_method == "path":
-        full_prefix = (
-            store_context.get("full_prefix", "/store/")
-            if store_context
-            else "/store/"
-        )
-        cookie_path = f"{full_prefix}{store.subdomain}/storefront"
-
+    # Set cookie with path=/ so it's sent with all requests
+    # (platform prefix varies between dev and prod, broad path avoids mismatch)
     response.set_cookie(
         key="customer_token",
         value=login_result["token_data"]["access_token"],
@@ -202,12 +187,12 @@ def customer_login(
         secure=should_use_secure_cookies(),
         samesite="lax",
         max_age=login_result["token_data"]["expires_in"],
-        path=cookie_path,
+        path="/",
     )
 
     logger.debug(
         f"Set customer_token cookie with {login_result['token_data']['expires_in']}s expiry "
-        f"(path={cookie_path}, httponly=True, secure={should_use_secure_cookies()})",
+        f"(path=/, httponly=True, secure={should_use_secure_cookies()})",
     )
 
     return CustomerLoginResponse(
@@ -237,25 +222,9 @@ def customer_logout(request: Request, response: Response):
         },
     )
 
-    store_context = getattr(request.state, "store_context", None)
-    access_method = (
-        store_context.get("detection_method", "unknown")
-        if store_context
-        else "unknown"
-    )
+    response.delete_cookie(key="customer_token", path="/")
 
-    cookie_path = "/storefront"
-    if access_method == "path" and store:
-        full_prefix = (
-            store_context.get("full_prefix", "/store/")
-            if store_context
-            else "/store/"
-        )
-        cookie_path = f"{full_prefix}{store.subdomain}/storefront"
-
-    response.delete_cookie(key="customer_token", path=cookie_path)
-
-    logger.debug(f"Deleted customer_token cookie (path={cookie_path})")
+    logger.debug("Deleted customer_token cookie (path=/)")
 
     return LogoutResponse(message="Logged out successfully")