Deployment: finish wiring live Shopify connect + backend (Cloud Run)

[StockerMC]

Tracking the remaining work to take Maatchaa from the current demo to live stores connecting and getting matched. Most of this is config/infra/deploy that needs account access rather than code. Code-side review and fixes are in PRs #5-#10.

Context

• The demo dashboard runs on Vercel today.
• Shopify OAuth is implemented in the Next.js frontend (/api/shopify/install + /callback); it does not need the Python backend. Connect works on Vercel once the app credentials are set.
• Product sync was ported to TS in feat(shopify): port product sync to TypeScript #10 (callback triggers POST /api/shopify/sync), so a connected store populates its catalog without the backend.
• Creator discovery (YouTube -> Gemini -> embeddings -> Pinecone) is the piece that still needs the Python worker.

1. Wire up live Shopify connect (Vercel + Shopify dashboard)

• Set on Vercel (production): SHOPIFY_API_KEY, SHOPIFY_API_SECRET, SHOPIFY_SCOPES
• Set SHOPIFY_REDIRECT_URI=https://www.maatchaa.co/api/shopify/callback
• Set NEXTAUTH_URL=https://www.maatchaa.co (the post-connect sync redirect needs it)
• In the Shopify Partner Dashboard, set the app's allowed redirect URL to the same callback
• Test the flow end to end: /get-started -> authorize -> dashboard with products synced

2. Review NEXT_PUBLIC_API_URL (Vercel config, not code)

• Since the backend isn't deployed, either remove it or point it at the backend URL once Migrate backend API routes to Next.js #4 is done. If left at a local value it just adds latency before the app falls back to the local /api/* routes.

3. Backend access control (before the backend is exposed)

• Add a shared-secret (INTERNAL_API_KEY) guard to the backend's internal endpoints before it is deployed publicly. Details and a sample decorator are in the local backend review notes.

4. Deploy the Python backend (Google Cloud Run + Upstash Redis, both free tier)

• Cloud Run for the API + worker (arq job queue). Vercel can't host the long-running worker.
• Upstash Redis (free) for the job queue.
• Set backend env: SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, COHERE_API_KEY, PINECONE_API_KEY, GEMINI/GOOGLE keys, YOUTUBE_API_KEY, SHOPIFY creds, REDIS_URL, INTERNAL_API_KEY.
• After deploy, point NEXT_PUBLIC_API_URL at the Cloud Run URL (ties into Enhance dashboard, implement Shopify OAuth, and redesign homepage #2).
• CORS already allows https://www.maatchaa.co (handled in fix(backend): harden email, OAuth, CORS, and error handling #9).

5. Schema redesign phases 2-4 (alongside #4)

• Proposals in docs/schema-redesign.md: retire the legacy v2 tables, consolidate merchant + creator identity, move worker tables out of public. These need coordinated API.py + frontend edits, so they land with the backend work. Phase 1 (drop product_pages/matches) is done in chore(db): drop dead tables (product_pages, matches) #8.

Open PRs to merge first

#5 demo fixes, #6 RLS, #7 schema docs, #8 drop dead tables, #9 backend hardening, #10 TS product sync