fix(#108): make catalogue lifecycle backend-authoritative

[EcstaceeLOR]

Summary

Fixes the production gap where Browse could show the new lifecycle tabs while the Cloudflare Worker still served stale/older product state.

Backend correctness

• Adds a real D1-backed regression test that proves a product moves available -> checked_out -> available -> owned from persisted payment/product state.
• Verifies the public product list exposes exactly one lifecycle state for the product at each step.

Deployment safety

• Adds npm run deploy:api / API workspace deploy scripts.
• Adds a manual Deploy API Worker GitHub Actions workflow that typechecks/tests before Wrangler deployment.
• Deploys the Git commit SHA as APP_VERSION and verifies /api/health reports the same SHA after deployment.
• Documents that Vercel frontend and Cloudflare Worker are independent production deployments.

Production Worker deployment still needs to be performed before #108 is closed, because the current symptom is caused by frontend/API version drift.

Refs #108

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
nimtrace	Ready	Preview	Sep 23, 2026 9:06pm UTC