Harden storefront web for v0.1

[roncodes]

Summary

• complete the single-store v0.1 customer journey across catalog, search, product configuration, cart, authentication, checkout, orders, and account profile editing
• integrate the merged Storefront API contracts for authenticated customer updates, cash pickup, idempotent capture, and server-verified Stripe checkout
• harden server boundaries, customer cookies, validation, rate limiting, redirects, runtime configuration, error states, metadata, product identifiers, and effective sale pricing
• add production Docker/runtime configuration, health checks, operations, architecture, deployment, release, and validation documentation
• add standard Fleetbase CI, CodeQL, dependency review, container scanning, Codecov upload, Docker publication, and dev-v* release workflows
• enforce exact 100% unit coverage and add desktop/mobile Playwright coverage for the release-critical journeys

Validation

• pnpm install --frozen-lockfile
• pnpm verify
  • lint
  • TypeScript
  • 85 unit tests across 17 files
  • exact 100% statements, branches, functions, and lines (2690/2690 statements; 900/900 branches; 183/183 functions; 2690/2690 lines)
  • clean production build with 31 routes
  • 24/24 Playwright scenarios across desktop Chromium and Pixel 7
• pnpm audit --audit-level high — no known vulnerabilities
• Actionlint validation of all workflows
• Docker Compose configuration and runtime health tests
• container executes as the non-root storefront user without npm/pnpm
• Trivy filesystem/image/secret scans — zero HIGH or CRITICAL findings
• live local Storefront API validation for catalog, product variants/addons, cart persistence, cash pickup, and profile editing
• GitHub-hosted CI, Codecov project/patch, CodeQL, dependency review, Docker smoke, and Trivy checks passed

Release gates requiring environment or maintainer access

• deploy a review/demo environment with customer credentials
• complete a real Stripe test-mode payment against the target release API
• complete documented manual keyboard, screen-reader, zoom, contrast, and reduced-motion checks

Related API documentation

The critical Storefront API behavior is documented in fleetbase/postman#54. No additional backend code change was required after the Storefront API fixes already merged into dev-v0.4.20.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.