Store-scoped admin URLs

The whole admin now lives under /s/<store-slug>. Every screen resolves its store from the URL rather than from whatever store your session last touched, and the slug is carried through OAuth provider callbacks in a signed cookie so connecting an integration lands you back where you started. Links and bookmarks point at one specific store, teams running several stores stop acting on the wrong one by accident, and every store id arriving in a request is membership-checked before anything is read or written.