feat(mall): read the store directory from the API

Wave 5: the store directory, store home and product-page store card stop reading
MOCK_STORES, and the payment and order surfaces name their shop.

- a `shop_profiles` table beside `shops`, so the identity model both consoles
  consume is untouched, with a public `GET /api/shops` and `GET /api/shops/{slug}`
  and an admin `PUT /api/admin/shops/{id}/profile`
- a shop with no profile is still listed, with the fields absent rather than
  invented; the pages guard every block, and a missing logo renders an
  initial-letter placeholder
- `scripts/seed-demo.mjs` upserts a profile per demo shop, since profiles hang
  off shops that script creates
- payment and order pages resolve shop ids to names from one cached shop read,
  retiring the generic "Shop" label
- three things went rather than being faked, following the wave-1 precedent:
  `distanceKm` and its sort (no geo model), the store home's sales/comments
  sorts, and its "best sellers" rail (no sales model)
- `lowestSku` moved out of the fixed-data module into `apps/mall/utils/product.ts`
  and re-exported, so live pages stop importing the mock module for a pure
  helper

Verified: 28 backend tests green including five new shop tests; all three
frontends build; the directory, store home, store card and order cards all render
real data with no distance or sales claims; the fixed-data rollback still renders
the store surfaces with the backend stopped.

Note: `nuxt build` does not typecheck in this repo (no `typescript.typeCheck`,
no `vue-tsc`), which AGENTS.md implies it does. A re-export used here created no
local binding and broke internal callers at runtime while the build stayed green;
`docs/TBD-migrate-wave.md` records the gap.

OpenSpec change: openspec/changes/replace-mock-api-wave-5

apps/mall/plugins/api.ts

@@ -12,6 +12,7 @@ type LiveDomain =
   | "catalog"
   | "currency"
   | "content"
+  | "shops"
   | "cart"
   | "orders"
   | "shipments"
@@ -31,6 +32,7 @@ const LIVE_PICKS = {
   }),
   currency: (a: ApiClient) => ({ listCurrencies: a.listCurrencies, convert: a.convert }),
   content: (a: ApiClient) => ({ getHomeContent: a.getHomeContent }),
+  shops: (a: ApiClient) => ({ listShops: a.listShops, getShop: a.getShop }),
   cart: (a: ApiClient) => ({
     getCart: a.getCart,
     addCartItem: a.addCartItem,
@@ -61,6 +63,7 @@ const DEFAULT_LIVE_DOMAINS: LiveDomain[] = [
   "catalog",
   "currency",
   "content",
+  "shops",
   "auth",
   "cart",
   "orders",