feat: put what the shop holds into a site export

[JasonYv]

Stacked on #9 (the race tests).

What this is

A site export is how an operator leaves with what is theirs, and the shop handed Mallok nothing for it: variants, prices, the stock ledger, orders and inquiries were in no backup. They are now (design §19).

exportFiles returns a JSON file for each, under shop/, with a manifest and the shop's own settings: a row an object, as stored, so that an amount stays whole minor units and nothing a buyer typed is rewritten. A variant carries its product's slug as well as its translation group, which only this database knows. Carts, exchange rates and the scheduler's state stay behind, and of an inquiry the cart it came from and the mark of who sent it.

Tables are read with *, so a column a migration adds is not forgotten — and a test lists every column of every exported table, so that a new one is looked at before it leaves the shop.

A table past 5,000 rows, or files past 16 MB of text together, fail the export rather than be cut short: Mallok then says there is no backup, where a file missing rows would have passed for one.

An independent review, and what it found

Twelve things, each checked before it was acted on. The ones that mattered most:

• A price whose variant was gone was left out, and the manifest's count with it.
• The first limit, 20,000 rows, guarded nothing: by the review's measure that much came to more than a Worker's memory.
• The reason for a refusal does not reach the operator. Mallok's command line and admin print the plugin's id alone and suggest disabling the plugin — which gives a backup with nothing of the shop's in it. The reason is logged now, and SECURITY.md says not to follow that suggestion.
• Four wrong exports passed every test. Each is caught now.
• The helper from the previous pull request checked less than it said; it is told how many readings a function makes, and refuses calls that never write.

How it was verified

Check	Result
lint, type check, build, both smoke runs, the preview check	Pass
Tests inside workerd	810 of 810; 28 of them the export's
Red and green	39 deliberate breakages of the export and the helper in two rounds, all noticed in the end
The smoke run	reads the shop's nine variants, twenty-seven prices and one inquiry out of the export of a real local Worker, beside the inquiry plugin's own file, and was seen to fail with the export unwired

Not verified, and not there

• mallok export itself was not run against this site: the tests read the endpoint it reads.
• Nothing was deployed. What an export costs a Worker in CPU and memory is not known; the limits are guards, not measurements, and on the smallest plan the CPU allowance may stop an export well before them.
• Nothing imports these files, and a shop can outgrow its export and take the site's backup with it. Both wait for Mallok.