Authorize Storefront customer profile updates

[roncodes]

Summary

• require an authenticated Storefront customer token for profile updates
• verify the requested contact is owned by the authenticated customer
• reject missing-token and cross-customer mutations with HTTP 403
• preserve existing not-found and valid-owner update contracts
• add regression coverage for both authorization failures

Verification

• complete Storefront server unit suite passes
• customer controller suite: 26 tests, 162 assertions
• PHP-CS-Fixer reports no changes
• git diff check passes

API and review notes

Customer update requests now require Customer-Token and may return HTTP 403. The API specification and Postman customer update requests should be updated. Authentication and customer-data handling require human review before merge.

Static analysis baseline

The repository type command is currently blocked by its existing configuration and the touched controller has extensive pre-existing PHPStan findings. This PR does not expand scope into that baseline cleanup.