feat: add Shopify refund guardrail example

[trungkien1992]

/claim #7

Summary

Adds a production-style Shopify refund guardrail example at the exact requested path, /examples/shopify-guardrail.

The example receives Shopify refunds/create webhooks, verifies Shopify HMAC signatures before parsing, builds an APort payments.refund.v1 verification context, fails closed on unsafe/error states, and flags denied refunds for manual review.

Acceptance Criteria Mapping

• Complete Shopify app/refund guardrail example: src/app.js, src/server.js, src/shopify.js
• APort verification: src/aport.js sends payments.refund.v1 context
• Refund processing with policy checks: allow path approves, deny path returns manual-review response
• Error handling: invalid HMAC, malformed JSON, missing config, and APort deny/error are covered
• Documentation: README.md, env.example, replay fixtures, and local replay script
• Tests: tests/app.test.js covers allow, deny, invalid HMAC, malformed JSON, missing config, and health

Testing

cd examples/shopify-guardrail
npm test

Result locally: 6 tests passed.

Notes

This intentionally keeps dependencies minimal and injects APort/Shopify clients for deterministic tests without requiring real credentials. Real store credentials can be added through the documented environment variables.