feat: migrate auth to OAuth client credentials grant

Replace static SHOPIFY_ADMIN_ACCESS_TOKEN with the OAuth client
credentials grant (SHOPIFY_API_KEY + SHOPIFY_API_SECRET). Shopify
deprecated the in-admin custom app flow on Jan 1, 2026; Dev Dashboard
apps expose a Client ID + Client Secret instead of a copy-paste token.

The new auth module provides a cached token provider that exchanges
credentials on first use, refreshes 120 s before the ~24 h expiry,
dedupes concurrent refreshes (single-flight), and auto-invalidates on
a mid-session HTTP 401.