feat!: build on @fleetbase/sdk 2 instead of a bundled 1.2.13

[roncodes]

Why

Storefront 1.2.0 bundled its own frozen copy of @fleetbase/sdk@1.2.13, axios included, into the ESM and CommonJS builds. As a result:

• Storefront never actually used core SDK 2. Apps that upgraded @fleetbase/sdk still made every Storefront request through the old axios adapter.
• Apps ran two copies of the core SDK. Resources and adapters from Storefront were not the same classes as the app's (instanceof Order failed), and adapter headers were stored in two different shapes.
• Core SDK socket support couldn't reach Storefront requests. The socket-auth work, and the socket callbacks planned next, ship in core SDK 2.x.

The bundle existed because 1.2.13's package entries didn't resolve in webpack or in CommonJS. SDK 2 fixed its packaging: proper exports, its own declarations, and a dependency-free Fetch transport.

What changes

• @fleetbase/sdk ^2.0.0 becomes a regular dependency.
  • The ESM and CommonJS builds import it instead of inlining a copy.
  • The self-contained browser bundle still inlines it.
  • axios and its override pins are gone from the dependency graph.
• The local @fleetbase/sdk declaration shim is removed. Sources are typed against the SDK 2 declarations.
• StorefrontStore now relies on SDK 2's Store, which already provides extendActions and serialize. It narrows findAll and query to collections, so Storefront's public types are unchanged.
• StorefrontResource exposes id as a string. It leaves update and empty open so cart and store APIs keep their own signatures.
• Signed-out customer requests send no Customer-Token header. Previously they sent an empty one.
• dist and types are rebuilt.

Behaviour notes (breaking, hence v2.0.0)

• Resources follow core SDK 2. For example, getAttribute(name, fallback) now returns the fallback for null values as well as missing ones.
• The setAdapter methods on Customer and DeliveryServiceQuote are now inherited instead of redefined. The public API snapshot is updated for that; no method was removed.

Stacking

This branch is built on #22 (customer.socketToken()), so the two don't conflict over dist and types. Until #22 merges, this diff also shows #22's commits. Merge #22 first.

Verification

• 24/24 tests pass with 100% statement, branch, function and line coverage. That includes a new test for the base resource's update/empty and missing store hours.
• Strict typecheck passes for sources and for the consumer type fixtures.
• Lint and format checks pass.
• The bundle builds:
  • ESM and CJS import @fleetbase/sdk externally;
  • no axios appears in any artifact.
• publint and arethetypeswrong pass (node16 CJS/ESM, bundler).
• Not run locally: the packed-tarball framework consumers (Vite, webpack, Next.js, Ember). CI runs those.

Follow-up

Once fleetbase/fleetbase-js#47 publishes @fleetbase/sdk 2.1.0, raise the dependency to ^2.1.0. That release fixes the Node transport (fleetbase/fleetbase-js#46), which matters for Storefront under Node and SSR.