Sync 2026-09-29: 9 changes

[operator888]

Synced from the working repository.

• docs(readme): Stripe, PayPal and Klarna ship free in the core — say so
• Navigation editor, and product categories as a manageable tree
• Accessibility: WCAG 2.1 AA checked in CI, and what it found fixed
• Storefront starter, headless receipt links, and fixes from the independent review
• fix: npm run dev loads .env; webhook event list matches what fires; docs match the code
• deps: Bump the react group across 1 directory with 4 updates
• test(change-feed): lock-holder child retries SQLITE_BUSY while taking the lock
• Restore what the #113/#118 merges dropped, and guard the CHANGELOG
• Bulk product edit, and search suggestions as you type

Checklist

• npm run build passes (this is astro check && astro build)
• npm test passes (unit + smoke on the lowdb driver)
• Storage: npm run smoke:libsql and npm run smoke:relational pass
• API contract: unchanged — or tests/smoke.mjs was updated to match
• Stored data shape: unchanged — or a migration was added
• I have read the CLA and am willing to sign it