Audit fixes: security hardening, bug fixes, throttle retries, and docs UI refresh

[hmawla]

Security

• Fix all 10 npm audit vulnerabilities (vite/vitest chain, qs) via npm audit fix
• get-token: cryptographically secure OAuth state (crypto.randomBytes instead of Math.random)
• get-token: HTML-escape reflected OAuth params in callback pages (XSS fix), URL-encode client_id
• config: validate and normalize SHOPIFY_STORE_NAME (accepts bare name, full domain, or URL; rejects unsafe characters before URL interpolation)

Bug fixes

• update_webhook: remove misleading topic param (Shopify does not allow topic changes after creation)
• create/update_product_image: implement previously dead position and variant_ids params via productReorderMedia and productVariantAppendMedia
• pages: throw on mutation userErrors instead of silently returning them; use shared gid helper
• list_inventory_levels: wire up the declared-but-ignored page_info cursor
• create_product: null checks on chained mutation results, and clear partial-failure errors that include the created product ID
• index: report real package version instead of hardcoded 1.0.0

Performance and reliability

• ShopifyClient: automatic retry with exponential backoff on HTTP 429 (honors Retry-After) and GraphQL THROTTLED errors
• searchQuery helper: quote and escape values containing spaces or quotes so title filters with spaces work
• throwOnUserErrors: include field paths in error messages
• menus: replace hand-duplicated 3-level nested update schema with a recursive schema; accept numeric IDs or GIDs

Docs and UI

• docs page: 80 to 136 tools, 12 to 18 categories, drop stale REST claim, add Pages/Menus/Files/Themes/Bundles/Apps cards, modern Discounts card, both auth modes documented, full scope list, copy-button success feedback
• README: correct tool descriptions for webhooks, images, and menus
• AGENTS.md: remove stale note about 6 failing tests

Tests: 93 to 112 passing (new coverage for retries, store-name normalization, and shared helpers)

https://claude.ai/code/session_01TyAU1S8RuL3fyR7S7B2NYd