v1.5.9 — Storefront fixes + POS parked-cart cleanup

Historical note (2026-07-15): This release was rewritten with
git filter-repo on 2026-07-15 to remove a set of Spwig HQ-internal
apps (developer_portal/, license_checkout/, marketplace_checkout/,
and four companion files in accounts/) that shipped in the OSS
distribution by mistake. Runtime behavior for Community installs is
unchanged — the removed code was gated behind SPWIG_IS_HQ and never
activated on Community builds. This tag now points at the rewritten
commit; the original commit SHA is no longer reachable via the tag.

---

Bug-fix release addressing three regressions found during v1.5.8
canary deployment on the demo fleet, plus a missing Celery beat
schedule for expired POS parked carts.

Fixed

• Storefront add-to-cart 500. frontend-utils.js delegated
  showNotification() to AdminModal.toast(), but AdminModal
  only loads in the admin bundle — every storefront notification
  threw ReferenceError. Restored the inline DOM toast.
• Guest wishlist 401. WishlistViewSet.product_ids required
  authentication, but product-card.js hits it on every page for
  heart-button state including for guests. Now AllowAny, with an
  empty short-circuit for unauthenticated requests.
• Admin help search 500. Unquoted numeric YAML (9.99) in the
  price-charming topic keywords crashed the keyword iteration.
  Coerced iteration to str in both the classic search action and
  the semantic-search chunker.

Added

• Merchant help topics for voucher CSV/XLSX import (from 1.5.5) and
  hosted-services free tier (from 1.5.7).
• POS help topics updated after 1.5.8 removed the upgrade page.
• Hourly cleanup of expired POS parked carts. Runs at :15 with a
  55-minute expiry. Requires celery-beat restart on upgrade
  (installer/upgrader handles this automatically; source-form
  operators may need docker compose restart celery_beat).

Upgrade notes

No merchant action required for installer-based installs. Source-form
users: git pull && docker compose build && docker compose up -d,
then restart celery_beat to pick up the new schedule.

Full changelog: CHANGELOG.md