refactor: rename marketplace to storefront across the entire monorepo

Comprehensive rename of all marketplace references to storefront:
- API module: apps/api/src/modules/marketplace/ → storefront/
- Components: MarketplaceHeader → StorefrontHeader, MarketplaceShell →
  StorefrontShell, MarketplaceFooter → StorefrontFooter
- Types: marketplace-homepage.ts → storefront-homepage.ts
- Test files: employee-marketplace-* → employee-storefront-*
- All source code identifiers, imports, route paths, and strings
- Documentation (docs/), CI config (.gitlab-ci.yml), scripts
- Dashboard, admin, storefront workspace references
- Prisma field names preserved (isListedOnMarketplace, marketplaceRating,
  marketplaceFunnelEvent) as they map to database schema

Validation:
- API type-check: 0 errors
- Storefront type-check: 0 errors
- Dashboard type-check: 0 errors
- Full monorepo type-check: only pre-existing admin TS18046

docs/SECURITY_HARDENING_LEFTOVER_APPLIED_REPORT.md

@@ -60,15 +60,15 @@ Changed files:
 
 - `apps/api/src/app.ts`
 - `apps/dashboard/src/middleware.ts`
-- `apps/marketplace/src/middleware.ts`
+- `apps/storefront/src/middleware.ts`
 - `apps/admin/src/middleware.ts`
 - `apps/dashboard/src/middleware.test.ts`
-- `apps/marketplace/src/middleware.test.ts`
+- `apps/storefront/src/middleware.test.ts`
 
 What changed:
 
 - API now rejects requests containing `x-middleware-subrequest` before route handling.
-- Dashboard, marketplace, and admin Next middleware now reject the same header at the app layer.
+- Dashboard, storefront, and admin Next middleware now reject the same header at the app layer.
 - Added/updated middleware tests for the rejection path.
 
 Security effect: