feat(mall): read the store directory from the API

Wave 5: the store directory, store home and product-page store card stop reading
MOCK_STORES, and the payment and order surfaces name their shop.

- a `shop_profiles` table beside `shops`, so the identity model both consoles
  consume is untouched, with a public `GET /api/shops` and `GET /api/shops/{slug}`
  and an admin `PUT /api/admin/shops/{id}/profile`
- a shop with no profile is still listed, with the fields absent rather than
  invented; the pages guard every block, and a missing logo renders an
  initial-letter placeholder
- `scripts/seed-demo.mjs` upserts a profile per demo shop, since profiles hang
  off shops that script creates
- payment and order pages resolve shop ids to names from one cached shop read,
  retiring the generic "Shop" label
- three things went rather than being faked, following the wave-1 precedent:
  `distanceKm` and its sort (no geo model), the store home's sales/comments
  sorts, and its "best sellers" rail (no sales model)
- `lowestSku` moved out of the fixed-data module into `apps/mall/utils/product.ts`
  and re-exported, so live pages stop importing the mock module for a pure
  helper

Verified: 28 backend tests green including five new shop tests; all three
frontends build; the directory, store home, store card and order cards all render
real data with no distance or sales claims; the fixed-data rollback still renders
the store surfaces with the backend stopped.

Note: `nuxt build` does not typecheck in this repo (no `typescript.typeCheck`,
no `vue-tsc`), which AGENTS.md implies it does. A re-export used here created no
local binding and broke internal callers at runtime while the build stayed green;
`docs/TBD-migrate-wave.md` records the gap.

OpenSpec change: openspec/changes/replace-mock-api-wave-5

packages/shared/src/api.ts

@@ -17,6 +17,8 @@ import type {
   ProductStatus,
   Shipment,
   Shop,
+  ShopProfile,
+  ShopProfileInput,
   Sku,
   User,
 } from "./types";
@@ -165,6 +167,9 @@ export interface ApiClient {
   listMyInvoices(): Promise<Invoice[]>;
   /** Public home-page marketing content: banners, promos, quick links, floor adverts. */
   getHomeContent(): Promise<HomeContent>;
+  /** Public store directory: active shops with whatever profile they have. */
+  listShops(): Promise<ShopProfile[]>;
+  getShop(slug: string): Promise<ShopProfile>;
   shop: {
     getMyShop(): Promise<Shop>;
     listMyProducts(q?: ShopProductQuery): Promise<Paged<Product>>;
@@ -237,6 +242,8 @@ export function createApi(opts: ApiClientOptions): ApiClient {
       r("POST", `/orders/${orderId}/invoice`, { title, tax_no: taxNo, kind }),
     listMyInvoices: () => r("GET", "/invoices"),
     getHomeContent: () => r("GET", "/content/home"),
+    listShops: () => r("GET", "/shops"),
+    getShop: (slug) => r("GET", `/shops/${slug}`),
     shop: {
       getMyShop: () => r("GET", "/shop/profile"),
       listMyProducts: (q = {}) => r("GET", "/shop/products", undefined, { ...q }),
@@ -274,6 +281,7 @@ export function createApi(opts: ApiClientOptions): ApiClient {
       }),
       getContent: () => r("GET", "/admin/content"),
       replaceContent: (kind, items) => r("PUT", `/admin/content/${kind}`, items),
+      setShopProfile: (id, body) => r("PUT", `/admin/shops/${id}/profile`, body),
     },
   };
 }