feat: shop UX polish — password reset / order email / multi-image / customer admin

Shop password reset:
- Configured 'shop_customers' password broker on the existing
  password_reset_tokens table
- ShopCustomer::sendPasswordResetNotification overrides Laravel default to
  send a ShopPasswordResetMail with a tenant-subdomain reset URL
- Routes /shop/password/forgot, /shop/password/email, /shop/password/reset/{token}
  + ShopAuthController showForgotPassword/sendResetLink/showResetPassword/
  resetPassword. Forgot view stays generic ("if it exists, we sent…") to avoid
  email enumeration. Login view links to "Am uitat parola".

Order confirmation email:
- ShopOrderConfirmationMail + nicely formatted HTML email template
- ShopOrderNotifier::placed now also emails customer_email (best-effort,
  warning-only logged on failure) alongside existing Telegram + staff push

Multiple images per Part:
- Part media collection switched from singleFile to multiple (max 8 in form)
- imageUrls() helper for galleries; imageUrl() still returns first for cards
- PartResource form: reorderable multi-upload
- Shop part detail: vertical thumbnails switch the main image via vanilla JS

ShopCustomerResource (tenant Filament, "Magazin" nav group):
- List with name/phone/email/client_id/orders_count/last_login_at
- Edit (no password field exposed)
- "Trimite reset parolă" action uses the new broker
- OrdersRelationManager shows the customer's orders read-only

Tests (7 new):
- forgot sends mail; forgot doesn't disclose unknown email; reset with valid
  token changes password; bad token rejected; order email when customer_email
  set; email skipped without it; Part has imageUrls() collection

Full suite: 130 passed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/web.php

@@ -101,6 +101,11 @@ Route::controller(\App\Http\Controllers\ShopAuthController::class)->prefix('shop
     Route::post('/login', 'login');
     Route::post('/logout', 'logout')->name('shop.logout');
     Route::get('/account', 'account')->name('shop.account');
+
+    Route::get('/password/forgot', 'showForgotPassword')->name('shop.password.forgot');
+    Route::post('/password/email', 'sendResetLink')->name('shop.password.email');
+    Route::get('/password/reset/{token}', 'showResetPassword')->name('password.reset');
+    Route::post('/password/reset', 'resetPassword')->name('shop.password.update');
 });
 
 // ─── Public WO tracking (no auth, tenant-scoped via subdomain) ──────