Document Storefront customer auth and Stripe capture contracts

[roncodes]

Summary

• send Customer-Token on both Storefront customer profile update routes
• document ownership enforcement and the 403 response for missing or mismatched customer credentials
• document idempotent/concurrent checkout capture behavior
• document server-side Stripe PaymentIntent verification and the 402, 409, 422, and 502 responses

Source of truth

Aligned with the merged Storefront module changes on dev-v0.4.20 (PRs #92, #94, and #95).

Validation

• npm run postman:lint
• 5 native collections and 3 environments validated
• Fleetbase Storefront API: 60 requests, 0 errors, 0 warnings

Test scope

The collection runner was not executed because the committed local environment intentionally contains no Storefront API credential. No secrets were added.

Documentation impact

The editable Storefront API collection and its repository reference README are updated. No generated fleetbase.io documentation was modified.

[roncodes]

Resolved the merge conflicts with main (from #55, which landed the same Customer-Token headers plus the contract-run restructuring).

What survived the merge:

• Both branches added identical Customer-Token headers to the two customer update requests, so those merged cleanly — only descriptions conflicted. Resolved by combining this PR's exact-403-contract wording with fix(storefront): align contract collection with customer authorization and Stripe payment verification #55's authoritative-identity framing.
• Capture checkout as order keeps fix(storefront): align contract collection with customer authorization and Stripe payment verification #55's functional change (captures the cash pickup checkout via {{cash_checkout_token}} so the contract run creates a real order) and gains this PR's documentation of idempotency and the 402/409/422/502 verification contract, with a note pointing at the Capture Stripe checkout without payment negative-contract request.
• The README auth/checkout-capture section is untouched by fix(storefront): align contract collection with customer authorization and Stripe payment verification #55 and merged cleanly.

Is this PR still necessary? Yes, in its reduced form: after #55, its remaining value is documentation — the README section, and the richer capture/update descriptions (idempotency, exact error strings, the full status-code contract). The functional header changes are now no-ops relative to main.

Validation after resolution: node scripts/validate-collections.js (5 collections, 3 environments) and postman collection lint on Fleetbase Storefront API — 62 items, 0 errors, 0 warnings.