refactor: rename marketplace to storefront across the entire monorepo

Comprehensive rename of all marketplace references to storefront:
- API module: apps/api/src/modules/marketplace/ → storefront/
- Components: MarketplaceHeader → StorefrontHeader, MarketplaceShell →
  StorefrontShell, MarketplaceFooter → StorefrontFooter
- Types: marketplace-homepage.ts → storefront-homepage.ts
- Test files: employee-marketplace-* → employee-storefront-*
- All source code identifiers, imports, route paths, and strings
- Documentation (docs/), CI config (.gitlab-ci.yml), scripts
- Dashboard, admin, storefront workspace references
- Prisma field names preserved (isListedOnMarketplace, marketplaceRating,
  marketplaceFunnelEvent) as they map to database schema

Validation:
- API type-check: 0 errors
- Storefront type-check: 0 errors
- Dashboard type-check: 0 errors
- Full monorepo type-check: only pre-existing admin TS18046

apps/dashboard/README.md

@@ -29,7 +29,7 @@ The app covers:
 
 It is distinct from:
 
-- the marketplace app, which is public and cross-company
+- the storefront app, which is public and cross-company
 - the company site app, which is public and company-branded
 - the admin app, which is platform-internal rather than tenant-scoped
 
@@ -65,7 +65,7 @@ This lets the dashboard run:
 
 - directly in dev on port `3001`
 - behind a reverse proxy
-- embedded under a shared marketplace/admin hostname while still loading its own chunks correctly
+- embedded under a shared storefront/admin hostname while still loading its own chunks correctly
 
 ## Top-Level Structure
 
@@ -92,7 +92,7 @@ apps/dashboard/
     api.ts              cookie-aware API fetch wrapper
     preferences.ts      language/theme persistence scoped per employee
     dashboardPaths.ts   normalizes basePath-aware routes
-    urls.ts             resolves marketplace/admin app links
+    urls.ts             resolves storefront/admin app links
   src/middleware.ts     auth gate and redirect logic
 ```
 
@@ -142,7 +142,7 @@ Important behavior:
 
 - public dashboard routes are limited to sign-in and forgot-password flows
 - all other `/dashboard/*` routes require the `employee_session` cookie
-- unauthenticated users are redirected either to the marketplace root or to `/dashboard/sign-in`, depending on host context
+- unauthenticated users are redirected either to the storefront root or to `/dashboard/sign-in`, depending on host context
 - duplicate `/dashboard/dashboard` paths are normalized back to `/dashboard`
 
 This means route protection is enforced before React renders the protected pages.
@@ -284,7 +284,7 @@ The onboarding flow then completes the initial tenant setup in three steps:
 
 1. basic company info via `PATCH /companies/me`
 2. brand/public profile via `PATCH /companies/me/brand`
-3. payment and marketplace settings via `PATCH /companies/me/brand`
+3. payment and storefront settings via `PATCH /companies/me/brand`
 
 This makes onboarding a dashboard-owned continuation of the API signup flow.
 
@@ -604,7 +604,7 @@ This is the broad configuration surface for the tenant.
 
 It includes:
 
-- public brand and marketplace profile
+- public brand and storefront profile
 - payment account identifiers
 - custom domain setup
 - rental policies
@@ -645,7 +645,7 @@ Examples in the code:
 
 It also coordinates with sibling apps:
 
-- `marketplaceUrl` links staff back to the public marketplace domain
+- `storefrontUrl` links staff back to the public storefront domain
 - `adminUrl` supports cookie-based handoff into the admin interface
 - host-aware URL rewriting allows the same app to function under external domains, internal Docker hostnames, and proxied environments