feat: send a cart as one request for a quote

[JasonYv]

Stacked on #7 (the line ceiling). Review that one first; this one's diff is against its branch. Merge in order, by fast-forward, so that the commits keep their ids.

What this is

Phase 1's last piece: the cart, sent as one request for a quote. The owner decided it is the shop plugin's to build (design §11, decision 10; what was built and found is §18).

A buyer	fills a cart, says on the cart page who to answer — a name and an address; a company, a phone number and a message if they like — and sends it. They land on the cart page again, empty, with the inquiry's number to quote. Nothing is charged and no stock is taken
A seller	is told by email, answerable straight to the buyer, and reads every inquiry in the admin with its lines: to mark, export as CSV, or delete
A size with no price	can go in the cart now, to be asked about. Without that an inquiry could only ask about what already has a price

How it works, in short

• POST cart/inquiry never renders: it answers 303 to the cart page with the inquiry's number, or the kind of reason none was made. Nothing a person typed travels in an address.
• The write is one batch: the inquiry, its lines as a snapshot, the job that owes its emails, the cart emptied. It happens only while the cart is still exactly what is being sent and the visitor is under five inquiries an hour, both asked inside the statement — so two forms at once store one inquiry, and a refused one leaves the cart alone.
• The emails are a job queued in that batch, not a call made on the strength of the write's answer.
• The form has no challenge in front of it: Mallok has nowhere to draw one on a plugin's page. What stands in its place, and what that does not stop, is in SECURITY.md. Because of it the email confirming to the buyer is built and off by default.

An independent review, and what it found

The finished work was given to a second reviewer with the properties it must hold and no account of how. It found the guards sound and eleven things wrong around them; each was checked before it was acted on. The ones that mattered most:

• The tests of the two races could not be relied on. Two requests sent with Promise.all interleave about half the time in this harness; the other half never reaches the guard inside the write. They now hold both requests at the write, and each guard, broken, is red every time.
• Deleting an inquiry does not delete its email from Mallok's queue, and the documents said that it did. They say what is true now, with what an operator has to do.
• A semicolon let a formula through the CSV export where it is the list separator.
• An address could carry a mailto: link's own syntax, which the admin links as stored.

How it was verified

Check	Result
lint, type check, build, both smoke runs, the preview check	Pass
Tests inside workerd	775 of 775, 137 of them new
Red and green	84 deliberate breakages in two rounds; three showed a test that was not sharp enough, which was made so. The four guards inside the write were each broken three times over and went red every time
The smoke run	sends a cart through the page's own form on a real local Worker, in German, reads the inquiry back the way the admin does, and was seen to fail with the confirmation's check taken out
In a browser, by hand	the form at ten widths in four languages; the keyboard's order; the fields refusing and accepting what the server does; one cart sent; the admin's panel, an inquiry opened with its lines, the delete action refusing an unticked box

Not verified

• Nothing was deployed, so no email was ever delivered: the tests end where Mallok's queue takes the message.
• The form was not tried with a screen reader. Whether a browser's autofill ever fills the field no person sees was not tried.
• The German, French and Spanish strings and emails were not read by a native speaker. The export was checked in its text, not in a spreadsheet.