feat(mall): address book wave 7 frontend, contract, and archive

Live addresses domain for the mall: shared contract (AddressBookEntry +
five client methods), mock adapter state v3, live domain pick, addresses
page CRUD, checkout saved-address picker with manual fallback, demo seed,
and the archived change plus address-book capability spec.

openspec/specs/address-book/spec.md

@@ -0,0 +1,27 @@
+# address-book Specification
+
+## Purpose
+TBD - created by archiving change replace-mock-api-wave-7. Update Purpose after archive.
+## Requirements
+### Requirement: Saved shipping addresses
+A customer SHALL be able to list, create, update and delete their own shipping addresses through the API. Every address operation SHALL be scoped to the authenticated customer; operating on another user's address SHALL return 404. Non-customer roles SHALL be rejected with 403.
+
+#### Scenario: manage own addresses
+- **WHEN** a customer creates, updates or deletes an address they own
+- **THEN** the change persists and appears in their address list
+
+#### Scenario: cross-user access
+- **WHEN** a customer requests an address id owned by a different user
+- **THEN** the API returns 404 as if the address did not exist
+
+### Requirement: Single default address
+Each customer SHALL have at most one default address, enforced by the database. The first saved address SHALL become the default. Setting a new default SHALL unset the previous one atomically. Deleting the default address SHALL promote the most recently created remaining address to default.
+
+#### Scenario: switch default
+- **WHEN** a customer marks address B as default while address A was default
+- **THEN** B is default and A is not, after one request
+
+#### Scenario: delete the default
+- **WHEN** a customer deletes their default address and other addresses remain
+- **THEN** the most recently created remaining address becomes the default
+