fix(shopify): drop "shopify" token from OAuth URLs

[guitavano]

Why

Shopify forbids the word "shopify" in an app's URLs (callback + host). The Shopify MCP's OAuth flow used it in both:

• callback path …/oauth/shopify/callback
• host sites-shopify.deco.site

What

• Callback path: /oauth/shopify/callback → /oauth/store/callback
  • Not /oauth/callback — that path is where the runtime mounts its own OAuth callback on this same origin, so it would collide.
• Host: sites-shopify.deco.site → mcp-commerce-store.deco.site
  • app.json connection.url + DEFAULT_SELF_URL in oauth.ts.
• Tests updated — 22 pass.

The connect page (/oauth/custom) was already clean.

Follow-ups (external, not in this PR)

• Infra: point mcp-commerce-store.deco.site at the service. The platform's automatic domain is sites-<site>.deco.site, so this host needs a custom-domain mapping (the deploy.json site field is left as shopify — it's just the internal deploy identity and isn't merchant-facing).
• Shopify Partners: register https://mcp-commerce-store.deco.site/oauth/store/callback in the app's redirect allowlist.

🤖 Generated with Claude Code

---

Summary by cubic

Removes "shopify" from public OAuth URLs to comply with Shopify’s URL policy. Callback path changes from /oauth/shopify/callback to /oauth/store/callback, and the default public origin changes from https://sites-shopify.deco.site to https://mcp-commerce-store.deco.site; app.json and registry.json now point to the new host.

• Rollout
  • Map mcp-commerce-store.deco.site to the service.
  • Add https://mcp-commerce-store.deco.site/oauth/store/callback to the Shopify app’s redirect allowlist.

^{Written for commit 8fff1eb. Summary will update on new commits.}