v0.10.0: 0.10.0 — a YAML tool can speak Storefront, and mints its own token

0.10.0 — a YAML tool can speak Storefront, and mints its own token

A tool declares api: storefront and reaches Shopify's other GraphQL API, for
the objects that exist on one schema only. Shop.brand — the merchant's logo,
square logo, cover image and brand colours — has no Admin equivalent, so before
this release no version of this package could reach it: the query loaded, the
server booted, the connection reported healthy, and the call failed with
Field 'brand' doesn't exist on type 'Shop'. The limit was the transport, not
the query, so no amount of rewriting would have helped.

api: is validated at load against exactly admin and storefront, and a
typo is refused naming both. A mistyped transport does not fail cleanly — it
reaches a real API that happens not to have the field, and Shopify's answer
sends the author off to fix a query that was never wrong.

The token is minted from the Admin credentials already configured. An app
installed through the Developer Dashboard with client credentials has no
Storefront token page anywhere in the Shopify admin — that panel belongs to
admin-created custom apps — so for the audience this package serves there is
nothing an operator could copy even if they wanted to.
storefrontAccessTokenCreate is an Admin mutation, which makes the existing
credentials the one route in. Existing tokens are listed and reused before
anything is created, concurrent callers collapse onto a single mint, and
nothing is requested until a storefront tool actually runs.

Set auth.storefront_access_token (or SHOPIFY_STOREFRONT_ACCESS_TOKEN) to
supply one instead.

A minted token reads what the app's unauthenticated_* scopes allow, not its
Admin ones. An app with fifty Admin scopes and none of these mints successfully
and then reads nothing, so a successful mint is not evidence of a usable token
— and the 401 says exactly that, because the obvious reading of a 401 is "bad
credential" and here it usually is not.

11 new tests; 703 pass; types and biome clean.