Cart abandonment recovery

When a customer enters an email anywhere in the cart/drawer/checkout flow, /api/cart/save serializes the cart contents (items + subtotal + source: drawer | checkout | exit-intent) into Redis under `cart:pending:{email}` with a 30-day TTL. Hourly cron (/api/cron/cart-abandon) walks every stale cart and fires a 3-stage drip via Resend / Klaviyo: - **c1** — 60 minutes after last update. "You left these in your cart" reminder. - **c24** — 24 hours. Adds the first soft incentive (typically free bac water). - **c72** — 72 hours. Final email with a 10% discount code. Each PendingCart tracks stagesSent[]; the cron is idempotent and won't double-fire a stage. After c72 ships, the cart enters terminal-recovered or terminal-lost state. Recovery URL: customers can resume their cart from any email or chat link via /resume?email=…&token=… where token is an HMAC of the email + ADMIN_TOKEN. The /resume page hydrates the zustand cart back into the browser. The Telegram bot can also surface a customer's saved cart on demand.