Add shared customer auth, cart handoff, and account dropdown.

Mirror Meshkee customer sessions onto the storefront, continue checkout on the customer dashboard, and show profile/orders/admin links under the header name.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/api/cart/items/[itemId]/route.ts

@@ -0,0 +1,47 @@
+import {
+  getBearerToken,
+  jsonResponse,
+  meshkeeFetch,
+  resolveBusinessId,
+  unauthorizedResponse,
+} from "@/lib/meshkee-server";
+
+type RouteContext = { params: Promise<{ itemId: string }> };
+
+export async function PATCH(request: Request, context: RouteContext) {
+  const token = getBearerToken(request);
+  if (!token) return unauthorizedResponse();
+
+  const { itemId } = await context.params;
+  const body = await request.json().catch(() => null);
+  if (!body?.quantity) return jsonResponse({ error: "quantity is required" }, 400);
+
+  const businessId = await resolveBusinessId();
+  if (!businessId) return jsonResponse({ error: "Tenant not found" }, 404);
+
+  const res = await meshkeeFetch(`/businesses/${businessId}/cart/items/${itemId}`, {
+    method: "PATCH",
+    token,
+    body: JSON.stringify({ quantity: body.quantity }),
+  });
+
+  if (!res.ok) return jsonResponse(res.data ?? { error: "Update failed" }, res.status);
+  return jsonResponse(res.data);
+}
+
+export async function DELETE(_request: Request, context: RouteContext) {
+  const token = getBearerToken(_request);
+  if (!token) return unauthorizedResponse();
+
+  const { itemId } = await context.params;
+  const businessId = await resolveBusinessId();
+  if (!businessId) return jsonResponse({ error: "Tenant not found" }, 404);
+
+  const res = await meshkeeFetch(`/businesses/${businessId}/cart/items/${itemId}`, {
+    method: "DELETE",
+    token,
+  });
+
+  if (!res.ok) return jsonResponse(res.data ?? { error: "Remove failed" }, res.status);
+  return jsonResponse(res.data);
+}