fix(ep-commerce): session fields that never propagate — accountId always undefined, locale/currency dropped

[field123]

Problem

Three session fields are written (or expected) but never reach the code that needs them. Verified on master:

1. EpCtx.accountId is always undefined. Both the example catchall page and proxy-routes.ts read session.user?.accountId — a field that does not exist. The account id lives at the raw session.epAccountId, which the public EpSession shape (create-ep-auth-better.ts) does not surface at all (epAccountId/epAccountToken/epAccountExpires are cookie-only).
2. locale/currency never reach EpCtx on either path: EpSessionData has no such fields, the proxy reads session.locale (always undefined), and the catchall never passes them into buildEpCtx. Net: normalizeCart(..., "en-US") always, and the currency header is never sent.

Consequences

Account-scoped reads silently behave anonymous; localized pricing/formatting is hardcoded to en-US.

Fix

• Surface account identity on the public EpSession (e.g. session.account: { id, token, expires } | null) and update both read sites
• Decide the source of truth for locale/currency (session field set by an endpoint vs. provider config) and thread it through buildEpCtx on both the SSR and proxy paths
• Tests: proxy and catchall produce an EpCtx with accountId after /ep/account/login; locale reaches normalizeCart

Found during the session-system audit behind the internals guide; see also #279 for the security workstream this sits beside.