Sweet Shop API

Next.js service — add routes under app/.

• GET /health
• GET /test
• POST /api/order — submit cart to AccountMate (Bearer when secret set)
• GET /api/secure/ping (Bearer required when WHOLESALE_API_SECRET is set)