Add TanStack Start experiment storefront

[fredericoo]

Stacked on #3995 (rename examples/ to experiments/). Review the diff against that branch.

TL;DR: adds a TanStack Start storefront to the experiments directory so we can see how Hydrogen's primitives fit a framework built around server functions and global request middleware. Feature set matches the React Router and Next.js templates (search, predictive search, sitemap, robots) plus the blog and account routes the sibling experiments carry.

What this changes

• New experiments/tanstack-start/ (React 19, Vite 8, @tanstack/react-start, file-based routing).
• One global request middleware (src/start.ts -> src/server/shopify-middleware.ts) owns the Hydrogen request lifecycle: request context, private Storefront client, encrypted customer session, handleShopifyRoutes short-circuit for /api/cart, /api/predictive-search, /account/*, /admin; context for server functions via next({ context }); session cookie commit and Hydrogen response headers afterwards. It knows nothing about individual routes.
• Server functions are the only data path. src/server/storefront-fn.ts is a createServerFn builder that declares the middleware as a dependency, so handler context is typed and Start dedupes the already-executed global run. Loaders run on the server during SSR and as RPCs on client navigation; the private token never reaches the browser.
• Not-found and Shopify URL redirects resolve server-side in one place (src/server/not-found.ts) and work identically on hard loads and client-side navigations, including query strings on redirect targets.
• src/lib/search-params.ts gives the router a URLSearchParams-based parseSearch/stringifySearch so Hydrogen's string-based URL contract (incl. repeated-key filters) round-trips unchanged.
• Sitemap and robots as server routes. Product JSON-LD. Analytics and consent via <ShopifyScripts>.
• Root .oxlintrc.json: this project is linted (negation after the wholesale experiments/** ignore, routeTree.gen.ts excluded) with no rule exemptions. The five components ported from the React Router template used to sit behind its complexity exemption; both copies are refactored to pass complexity: 12 / max-depth: 3 outright and the React Router entries leave the exemption too (only CollectionBrowse.tsx keeps an assertions-only override for its fetcher.data cast).
• dev:tanstack root script; rows in the root and experiments READMEs.

Developer impact

No @shopify/hydrogen changes, so no changeset. The one change outside the experiments directory is the React Router template: CartDrawer, CollectionCard, ProductCard, CollectionBrowse and routes/product.tsx are refactored to pass the complexity rule (same edits as the tanstack copies, no behaviour change; the portable e2e suite passes against it). The project README has a "Notes for the core SDK" section with friction worth a look:

• CartData index signatures trip TanStack's serializable-return check (worked around with a type-only StripIndexSignatures).
• parseCollectionParams output is not assignable to the Storefront API ProductFilter input (optional values, taxonomyMetafield without namespace).
• No public getStandardRoute, so server functions rebuild storefront paths by hand to resolve redirects.
• Storefront API errors arrive as HTTP 200 + errors; requireData surfaces them so a throttled API does not read as "not found".

UX impact

New storefront at experiments/tanstack-start, same design as the other experiments (core/tokens.css).

Out of scope

• Nitro. It was in the plan, but its dev proxy rewrites the request host to its internal worker without x-forwarded-*, so Hydrogen saw an http origin over dev:https and Customer Account login failed. Current TanStack Start hosting docs treat Nitro as one optional adapter, so this uses Start's own dev server and srvx for start (the documented Nitro-free Node path).
• E2E coverage (no sibling framework experiment has it).
• Sitemap pagination beyond 250 products/collections.

Risk

• Verified against the hydrogen-preview store in a browser: server-fn-only navigation (no *.myshopify.com requests from the browser), multi-value filters keep both repeated keys, after cursor dropped on filter change, variant options stay strings in the URL, add to cart opens the drawer, client-side navigation to a missing product or unknown path renders the 404 page, client-side navigation to /collections/hydrogen and /collections/x/products/y redirects, predictive search returns results, consent banner injected. / is cacheable; /account and /api/cart are private, no-store. build + start (srvx --prod) serve the same pages.
• Anything requiring dev:https (Customer Account login end to end) was verified up to the 303 into Shopify OAuth, not through a real login.

How to Test

1. pnpm install && pnpm run experiments:secrets:decrypt
2. pnpm dev:tanstack and open the printed URL.
3. Browse to a collection, toggle two values of one filter and change the sort; the URL should carry both filter keys and the grid should update without a full reload.
4. Open a product, change an option; the URL updates in place and the price/availability follow.
5. Add to cart; the drawer opens with the line. /cart shows the same line.
6. Type in the header search; suggestions appear. Submit to land on /search?q=....
7. Visit /collections/hydrogen by clicking a link you paste into the console (document.body.appendChild(Object.assign(document.createElement("a"), {href: "/collections/hydrogen", textContent: "x"}))) - it should redirect to /collections/backcountry without a page reload.
8. /sitemap.xml, /robots.txt, /blogs/news, /account.
9. For Customer Account: pnpm --filter @shopify/hydrogen-experiment-tanstack-start dev:https, open https://local.tryhydrogen.dev:5173/account, click "Log in".

[fredericoo]

little scope creep but this was refactored to respect oxlint's complexity and max lines so we can stop ejecting out of those rules

faced this when writing the tanstack app

[fredericoo]

that's what we were able to remove from the exceptions