Store API, not a new shopfront

This app is the Phase 1 order backend. The marketing site at mineral-manzi.co.za is unchanged and is not served from here.

Guest path: catalog → server cart → checkout → card (Yoco) or EFT (Ozow). If those keys are missing, checkout is a labeled MOCK payment. Paystack is not used for this one-time purchase.

How the static site should call this

See FRONTLINE.md. Public routes the existing storefront can fetch:

• GET /api/catalog
• POST /api/cart then POST /api/cart/:id/lines
• POST /api/checkout with method: "card" or "eft"
• POST /api/payments/mock-complete only when the response says mock: true
• GET /api/orders/:id for the confirmation

Merchant sign-in is cookie-based and same-origin at /admin. It is not for the public site.