feat(mall): run the transaction chain against the live API

Wave 3 of replacing the fixed-data mock adapter: cart, orders, shipments and
invoices flip together, so one purchase runs end to end against the backend.

- cart: CartItemView carries the line's shop and the SKU's stock, so the cart
  keeps grouping per shop and the quantity stepper caps at real stock instead
  of a hard-coded 999
- contract: Shipment.items is optional and Invoice.invoice_no nullable, both
  matching what the API actually returns. Invoice was declared twice in
  types.ts and TypeScript merges duplicate interfaces, so the duplicate had to
  go for the change to take effect at all
- an anonymous add-to-cart redirects to /login?redirect=..., and sign-in
  honours only same-origin paths
- the fixed-data adapter learns the new cart fields, and its persisted state
  key moves to v2 because a cart saved by an older build is no longer valid
- order surfaces drop their storeById lookups and keep the generic store label
  until the public store read arrives

Verified end to end: two-shop cart grouping with live shop names, stock caps
read from the API, checkout, payment, shipment, delivery confirmation and an
issued invoice. Rollback re-verified with every domain on fixed data and the
backend stopped.

Also checks off Wave 3 in docs/TBD-migrate-wave.md and re-points that file at
the mock content that remains.

OpenSpec change: openspec/changes/replace-mock-api-wave-3

apps/api/src/cart.rs

@@ -50,6 +50,11 @@ pub struct CartItemView {
     pub unit_price_minor: i64,
     pub currency: String,
     pub qty: i32,
+    /// Owning shop, so the storefront can group lines without the mock catalog.
+    pub shop_id: Uuid,
+    pub shop_name: serde_json::Value,
+    /// Current SKU stock; advisory for the quantity stepper. Checkout is authoritative.
+    pub stock: i32,
 }
 
 #[derive(Debug, Serialize)]
@@ -67,7 +72,8 @@ pub async fn cart_view(state: &AppState, user_id: Uuid) -> ApiResult<CartView> {
     let sku_ids: Vec<Uuid> = entries.iter().map(|(id, _)| *id).collect();
     let rows = sqlx::query_as::<_, CartRow>(
         "SELECT s.id AS sku_id, p.id AS product_id, p.name AS product_name, s.sku_code,
-                (p.images ->> 0) AS image, s.price_minor, s.currency
+                (p.images ->> 0) AS image, s.price_minor, s.currency, s.stock,
+                p.shop_id, sh.name AS shop_name
          FROM skus s
          JOIN products p ON p.id = s.product_id
          JOIN shops sh ON sh.id = p.shop_id
@@ -92,6 +98,9 @@ pub async fn cart_view(state: &AppState, user_id: Uuid) -> ApiResult<CartView> {
                     unit_price_minor: r.price_minor,
                     currency: r.currency,
                     qty: *qty,
+                    shop_id: r.shop_id,
+                    shop_name: r.shop_name,
+                    stock: r.stock,
                 })
         })
         .collect();
@@ -107,4 +116,7 @@ struct CartRow {
     image: Option<String>,
     price_minor: i64,
     currency: String,
+    stock: i32,
+    shop_id: Uuid,
+    shop_name: serde_json::Value,
 }

apps/api/tests/orders.rs

@@ -18,13 +18,39 @@ async fn stock_of(app: &common::TestApp, sku_id: &str) -> i32 {
 async fn checkout_splits_orders_per_shop_and_clears_cart() {
     let app = spawn_app().await;
     let admin = login_admin(&app).await;
-    let (_, _, _, sku_a) = setup_sellable(&app, &admin, "split-a", 1000, 5).await;
-    let (_, _, _, sku_b) = setup_sellable(&app, &admin, "split-b", 2000, 5).await;
+    let (_, shop_a, _, sku_a) = setup_sellable(&app, &admin, "split-a", 1000, 5).await;
+    let (_, shop_b, _, sku_b) = setup_sellable(&app, &admin, "split-b", 2000, 5).await;
     let (buyer, _) = register_customer(&app, "buyer").await;
 
     add_to_cart(&app, &buyer, &sku_a, 2).await;
     add_to_cart(&app, &buyer, &sku_b, 1).await;
 
+    // The cart view must carry the owning shop and current stock, so the
+    // storefront can group lines and cap quantity without the mock catalog.
+    let res = client()
+        .get(app.url("/api/cart"))
+        .bearer_auth(&buyer)
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(res.status(), 200);
+    let view: serde_json::Value = res.json().await.unwrap();
+    let items = view["items"].as_array().unwrap();
+    assert_eq!(items.len(), 2);
+    let shop_ids: std::collections::HashSet<String> = items
+        .iter()
+        .map(|i| i["shop_id"].as_str().unwrap().to_string())
+        .collect();
+    assert_eq!(shop_ids.len(), 2, "each line reports its own shop");
+    assert!(shop_ids.contains(&shop_a) && shop_ids.contains(&shop_b));
+    for item in items {
+        assert!(
+            item["shop_name"]["en"].as_str().is_some_and(|s| !s.is_empty()),
+            "line must carry a bilingual shop name"
+        );
+        assert_eq!(item["stock"], 5, "stock is the SKU's, before checkout decrements it");
+    }
+
     let orders = checkout(&app, &buyer).await;
     assert_eq!(orders.len(), 2, "one order per shop");
     let totals: Vec<i64> = orders