feat(mcp): ledger tools bridged into the CMS assistant /mcp + submodule bumps

The backoffice commerce build now merges the ledger service's full MCP
tool surface (/ledger-mcp) into /mcp via MountLedgerMCP — a JSON-RPC
bridge that forwards tools/call to the ledger service (single-writer
AOF preserved), gated by the shared MCP_API_KEY. Compose backoffice now
sets LEDGER_URL=http://ledger:8080.

Submodule bumps:
- backoffice: ledger MCP bridge + device approve-page sign-in gating
- slask-finder: safe returnTo after OIDC login + dep tidy
- go-cart-actor / go-image-gen / go-redirector / slask-tracking: dep updates

Infra: k8s order CHROME_CDP_URL pinned to the headless-shell ClusterIP
(DNS-rebinding guard) + shared invoice-issuer-config ConfigMap for the
invoice PDF seller block; platform go.mod refreshed (otel direct, x/sys).
docs/status.md notes the ledger tools on /mcp.

Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>

go.mod

@@ -4,15 +4,17 @@ go 1.26.2
 
 require (
 	github.com/rabbitmq/amqp091-go v1.12.0
-	golang.org/x/sys v0.46.0
+	go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel/trace v1.44.0
+	golang.org/x/sys v0.47.0
 )
 
 require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 )