Sweet Shop API

Next.js service — add routes under app/.

• GET /health
• GET /test
• GET /api/secure/ping (Bearer required when WHOLESALE_API_SECRET is set)