Move underlying library to shopify/shopify-app-php

[ryanmitchell]

shopify/shopify-api is abandoned — "no new features or security fixes are planned" — and Composer now suggests shopify/shopify-app-php (official, actively maintained, v1.x, PHP 8.2+) in its place.

The addon only ever used two things from the old library: the Graphql client and the Context version/config holder (no REST resources, no OAuth session handling — webhook HMAC is already hand-rolled). This PR swaps the dependency and keeps the blast radius small with a thin adapter.

Changes

New adapter — src/Clients/

• Graphql.php — wraps ShopifyApp::adminGraphQLRequest() behind the existing query(['query' => …, 'variables' => …]) call shape. Static shop() helper reduces the configured *.myshopify.com URL to the bare shop handle the new library expects.
• HttpResponse.php — status / body constructor + getDecodedBody(), matching what Shopify\Clients\HttpResponse returned (decodes the raw response body, so data / errors / extensions keys are all preserved).

ServiceProvider

• Removed Context::initialize() and FileSessionStorage — the new library has no global state.
• Registers a ShopifyApp singleton; client_credentials token exchange now goes through exchangeUsingClientCredentials() instead of a hand-rolled Http::asForm()->post().

Support/StoreConfig

• makeGraphqlClient() passes apiVersion as a constructor argument (was a Context::$API_VERSION mutation).
• The two near-identical admin_token / OAuth bind branches collapse into one
• Per-store client_credentials exchange uses a per-store ShopifyApp instance.

Consumers & tests

• 9 source files + 15 test files: one-line use swap from Shopify\Clients\ StatamicRadPack\Shopify\Clients\…`. No logic changes.
• Traits/ThrottlesShopifyRequests unchanged — getDecodedBody() still exposes extensions.cost.throttleStatus.

Dead config removed

• api_private_app, session_storage_path, auth_key, auth_password — ne.
• Http/Controllers/CP/DashboardController — canRunImport was gated on auth_key && auth_password (both had non-empty env defaults, so it was effectively always true). Now
  gated on url && (admin_token || client_id), matching `ServiceProvider::set
• Dropped the Windows SHOPIFY_SESSION_STORAGE_PATH note from the setup docs.

Breaking changes

This is a major release (7.x → 8.x). Upgrade notes added to docs/…/3.upgrading.md:

• Any code calling \Shopify\Clients\Graphql::query() directly must switch to the wrapper: \StatamicRadPack\Shopify\Clients\Graphql::query().
• The SHOPIFY_AUTH_KEY, SHOPIFY_AUTH_PASSWORD, SHOPIFY_SESSION_STORAGE_PATH config values are gone. They were only relevant to the removed REST/basic-auth path.

Behaviour notes

• shopify/shopify-app-php hardcodes https://{shop}.myshopify.com/admin/… for both GraphQL and token exchange. Non-.myshopify.com Admin API hosts are no longer supported (the
  Admin API is only served from *.myshopify.com anyway).
• Graphql::query() passes maxRetries: 0 to preserve the old no-retry behaviour; the library's built-in 429/5xx backoff can be enabled later if wanted.
• The client_credentials token now carries a real expires; the existing 1400s TTL is unchanged for now.

Testing

• vendor/bin/phpunit — 128 passing, 297 assertions.
• vendor/bin/pint — clean on all touched code (pre-existing style debt in config/shopify.php, Tags/Shopify.php, Jobs/ImportSingleProductJob.php left untouched to keep the diff focused).