Rename legacy storefront app and references to carplace

Replace storefront naming across source, tests, docs, config, and production scripts. Rename the legacy top-level app directory and Carplace component files, remove duplicate storefront startup scripts, and refresh the lockfile.

docs/project-design/api-routes.md

@@ -68,7 +68,7 @@ This is the default for dashboard/company management routes.
 
 ### Subscription Guard
 
-`requireSubscription` blocks company routes when the company status is `PENDING` or `SUSPENDED`. Public site and storefront routes are intentionally not behind this guard.
+`requireSubscription` blocks company routes when the company status is `PENDING` or `SUSPENDED`. Public site and carplace routes are intentionally not behind this guard.
 
 ### Role-Based Access Control
 
@@ -90,7 +90,7 @@ Admin roles are hierarchical:
 
 `requireRenterAuth` validates a Bearer token with `type === "renter"` and attaches `req.renterId`.
 
-`optionalRenterAuth` is used on storefront routes so public reads still work without a token.
+`optionalRenterAuth` is used on carplace routes so public reads still work without a token.
 
 ### API Key
 
@@ -136,7 +136,7 @@ The table below describes the current route groups mounted in `app.ts`.
 | `/api/v1/auth/employee` | Public plus employee JWT | Employee login, password reset, profile, language | Dashboard/staff authentication path |
 | `/api/v1/auth/renter` | Renter JWT for profile routes | Renter profile and push token | `signup` and `login` are currently disabled in this codebase |
 | `/api/v1/admin` | Admin JWT | Platform operations | Includes company admin, billing, subscriptions, pricing, audit, and admin-user management |
-| `/api/v1/storefront` | Public, optional renter JWT | Storefront discovery and reservation intake | Designed for discovery and lead capture across companies |
+| `/api/v1/carplace` | Public, optional renter JWT | Carplace discovery and reservation intake | Designed for discovery and lead capture across companies |
 | `/api/v1/site` | Public | White-label company site APIs | Drives each company-branded booking site |
 | `/api/v1/subscriptions` | Mixed | Plan listing, webhooks, subscription lifecycle | Public, webhook, and authenticated sub-routers share the same prefix |
 | `/api/v1/vehicles` | Employee JWT + tenant + subscription | Fleet management | Includes photos, status, calendar blocks, maintenance, and availability |
@@ -228,17 +228,17 @@ Customers are company-scoped CRM records, even when a renter identity also exist
 
 This is intentionally separate from renter identity because one renter may interact with multiple companies while each company still needs its own operational customer record.
 
-### Storefront and public site
+### Carplace and public site
 
 The public surface is split in two modules on purpose.
 
-`storefront` is the cross-company discovery layer:
+`carplace` is the cross-company discovery layer:
 
 - featured/public offers
-- storefront cities
+- carplace cities
 - listed companies
 - vehicle search
-- storefront reservation intake
+- carplace reservation intake
 - review submission by token
 - company public pages under `/:slug`
 
@@ -318,7 +318,7 @@ The admin router is broad because it covers platform operations across multiple
 - billing account and billing invoice operations
 - pricing config, plan features, and promotions
 - subscription overrides and extensions
-- storefront homepage configuration
+- carplace homepage configuration
 
 This is the only route group allowed to work across tenants.