Checkout carts are email-bound, not customer-linked (cart.customer_id unset)

[kilbot]

Surfaced by a Codex review during the save-card work (wcpos-com#283 / wcpos-medusa#67).

Problem

/api/store/cart creates carts with email: customer.email but does not forward the customer JWT to Medusa's createCart (src/services/core/external/medusa-client.ts). So cart.customer_id stays unset — carts (and the orders completed from them) are email-bound guests, not linked to the authenticated Medusa customer.

All storefront ownership checks already cope by comparing cart.email === customer.email, and the CustomerSession endpoint was just aligned to that model (wcpos-medusa#67). So this isn't blocking anything today.

Why it's worth fixing

• Orders in Medusa aren't linked to customer accounts → weaker reporting, account order-history relies on email joins, admin "customer" view is incomplete.
• It's the same root cause as the "Stripe Guest" issue feat(checkout): attach a persistent Stripe Customer at payment (stop 'Guest' sales) #264 fixed for payments — but for the cart/order entity itself.

Fix direction

Forward the auth token on createCart (and updateCart) the way createPaymentCollection/createPaymentSession already do (buildAuthHeaders(authToken) in the /api/store/cart route). Medusa then sets cart.customer_id from the auth context. Verify no side effects on the existing checkout, and that completed orders become customer-linked.

Medium change to a working flow — its own PR, with care.