Security: checkout requires a signed-in customer; a guest browses and keeps a cart, an account buys #27

src/shop.ts never checks who.role before placing or paying for an order, and the test suite exercises checkout anonymously. The direction says: browse as a guest, keep a cart, buy with an account. Done looks like: placing or paying for an order needs who.role of user or admin (identity from the forge's signed headers only); a guest reaching checkout is sent to /__forge/signin?to=/checkout with the cart kept; orders carry the buyer's forge id; tests cover guest-refused and user-allowed.

This is the same ground as #10 ("An order belongs to the account that bought it"), which is assigned and in flight, so I have marked this one as waiting for it rather than leaving two builders on the same file. The gap is real — shop.placeOrder (src/shop.ts:220) never looks at ctx.who, and I walked it just now: a request with no identity headers places an order and reaches /pay/:number?token=….

Two things from this issue that #10's body does not spell out, for whoever takes #10:

• A guest who reaches /checkout is sent to /__forge/signin?to=/checkout and comes back with the cart still in the cookie — the cart is a guest's, only the buying needs an account.
• The tests cover both sides: anonymous POST /checkout is refused and writes no row, a signed-in user's is accepted and the order carries the forge id.

If #10 lands with those, close this with it.

You've hit your weekly limit · resets Sep 20, 2am (UTC)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: You've hit your weekly limit · resets Sep 20, 2am (UTC) (api_error)

API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN)

Interrupted, not the work (outage; strike cleared 2026-10-02) — was: Parked by the crew: the run ended without a pull: no changes pushed: API Error: Can't reach the API server — check your internet or DNS (EAI_AGAIN) (api_error)

Checked after the park, at bb98ad6: this is done, and the parks are beside the point. #32 landed the rule this issue asks for — shop.placeOrder refuses an anonymous shopper before it writes anything (src/shop.ts:286), the checkout page offers the forge's sign-in instead of a form of our own, browsing and the cart stay open to anybody, and an order carries buyer_id/buyer_name.

It wants the click to close rather than a builder: my token is refused on PATCH state (403), so a person has to do it.