Stage 12 — Online Store: public catalog + cart + orders

Schema:
- online_orders (token-tracked, status workflow, delivery method/fee)
- online_order_items (price snapshot, fulfilled flag)
- part_cross_refs (OEM/equivalent codes for search)
- parts.is_published (shop visibility)

Storefront (ShopController, tenant subdomain, /shop):
- Catalog with search across name/article/brand/cross-refs, category +
  in-stock filters, live stock, white-label themed layout
- Part detail page with cross-ref codes
- VIN search → VinDecoder → guided catalog search
- Session cart (per-tenant key), guest checkout, order confirmation page
- Respects settings.shop.enabled (404 when off); tenant-guarded

Part::searchPublished matches cross-ref articles via whereHas.

Order notifications (ShopOrderNotifier, best-effort):
- Staff: Web Push to active users
- Customer: Telegram if phone matches a linked client

Filament (tenant):
- OnlineOrderResource under "Magazin" nav group, status workflow,
  items relation, "Onorează" action issues stock via WarehouseService (FIFO)
- PartResource: is_published toggle + column + bulk publish/unpublish +
  CrossRefsRelationManager
- Settings: shop section (enable, delivery methods, fee, free-over)
- Landing page: shop button when enabled

Tests (6 new):
- catalog 404 when disabled; lists published only; cross-ref search;
  order placement (token + items + total); fulfill issues stock;
  cross-tenant token isolation

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routes/web.php

@@ -18,6 +18,7 @@ Route::get('/', function () {
             'cars' => (array) ($tenant->settings['cars'] ?? []),
             'logoUrl' => $tenant->getLogoUrl(),
             'faviconUrl' => $tenant->getFaviconUrl(),
+            'shopEnabled' => (bool) data_get($tenant->settings, 'shop.enabled', false),
         ]);
     }
     // On the central domain → redirect to admin.
@@ -77,6 +78,21 @@ Route::post('/telegram/webhook/{slug}', [\App\Http\Controllers\TelegramWebhookCo
     ])
     ->name('telegram.webhook');
 
+// ─── Online Store (public, tenant-scoped via subdomain) ────────────
+Route::controller(\App\Http\Controllers\ShopController::class)->prefix('shop')->group(function () {
+    Route::get('/', 'catalog')->name('shop.catalog');
+    Route::get('/vin', 'vin')->name('shop.vin');
+    Route::get('/cart', 'showCart')->name('shop.cart');
+    Route::post('/cart/update', 'updateCart')->name('shop.cart.update');
+    Route::get('/checkout', 'checkout')->name('shop.checkout');
+    Route::post('/checkout', 'placeOrder')->name('shop.order.place');
+    Route::get('/order/{token}', 'orderStatus')
+        ->where('token', '[A-Za-z0-9]{16,32}')
+        ->name('shop.order');
+    Route::get('/part/{id}', 'part')->where('id', '\d+')->name('shop.part');
+    Route::post('/part/{id}/add', 'addToCart')->where('id', '\d+')->name('shop.cart.add');
+});
+
 // ─── Public WO tracking (no auth, tenant-scoped via subdomain) ──────
 Route::get('/t/{token}', [\App\Http\Controllers\TrackingController::class, 'show'])
     ->where('token', '[A-Za-z0-9]{16,32}')